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to improve the accuracy and speed of information on the height of any future ash 
cloud. An accurate assessment of the height of the initial ash plume is critical for 
predicting its subsequent movement and dispersion. A coordinated European 


approach to this problem is in process under the “Single European Sky” 
initiative. It is highly desirable to base future decisions about airspace use on 
scientific measurements since significant angst resulted when airspace was 
closed during Eyjafjallajékull’s eruption based on theoretical models and 
inaccurate observations. 

Further research and planning is urgently required. Another volcano in 
Iceland named Katla could potentially pump 10 times more ash into Europe’s 
skies than E+15. The volcano has a history of erupting every 40 to 80 years but 
has not done so since 1918. It is overdue! The only positive aspect of the 
situation is that this Icelandic volcano, at least, has a more pronounceable name 
than Eyjafjallajökull. 


ICE AND PRECIPITATION 


Ice and precipitation impact airplane operation in two areas. One is the effect 
they have on the airframe and engine, and the second is the effect on tire-ground 
contact. Unlike the previous atmospheric topics, these elements are daily 
occurrences, with severity and likelihood of encounter depending on the season 
and location. Safe operations depend on a coordinated team effort by airline 
maintenance crews, flight crews, and airport authorities, as well as ground and 
air traffic control (ATC). The technologies that help are many and depend on 
specific icing or precipitation conditions. Again, teamwork and procedures play 
an important role. Flight simulator training continues to be an effective tool in 
developing correct takeoff and landing procedures for ice-contaminated runways 
to keep safe operation possible. 

Developing all these procedures involves extensive wind-tunnel, 
environmental laboratory, and flight tests to fully understand the problems and 
show performance of the airplane under icing conditions. The contribution to 
safety in some of these cases is focused on understanding the limitations of the 
airplane under such adverse weather conditions. Only then is safety improved 
when those responsible for each aspect of the operation implement the 
procedures that come from these tests. 

In-flight icing is one of the FAA’s top weather research priorities. Improved 
operationally available, high-resolution, accurate forecasts of atmospheric icing 
conditions are needed. Several safety recommendations dealing with in-flight 
icing were issued as the result of the NTSB’s investigation of the ATR-72 
accident that occurred at Roselawn, Indiana on October 31, 1994. These 
recommendations and the findings from the investigation provided the major 
impetus to the icing research efforts of the FAA. 


Then again on January 9, 1997, Comair Flight 3272, an Embraer 120, crashed 
near Monroe, Michigan, destroying the airplane and killing all 29 people 
onboard. There were reports of moderate icing in the area at the time of the 
accident. In May of the same year, the NTSB issued four urgent safety 
recommendations to the FAA regarding icing. Almost concurrently, the FAA 
issued a notice of proposed rulemaking to modify operating procedures in icing 
conditions. Comair modified its operating procedures based on the FAA’s 
proposed rule, and the FAA issued a final rule. The Board also worked with the 
National Center for Atmospheric Research and the NASA Lewis Research 
Center regarding weather issues. In January 1998, Board personnel traveled to 
Brazil, where the airplane was manufactured, to review all pertinent test data on 
icing and to perform studies in the engineering simulator. 

Issues examined regarding this accident included flight crew training, 
operations in icing conditions, and aircraft performance. This accident resulted 
in several significant research activities, including the quantification of the loss 
of performance due to small amounts of surface roughness on a wing’s leading 
edge and the performance penalties associated with deicing boots. 

In recent years, the NTSB and FAA have become more definitive in the area 
of ice detection and prevention. On August 3, 2009, the FAA published a final 
rule that became effective September 2, 2009. Although the new rule does not 
address existing airplane designs, the FAA is considering similar rulemaking 
that would apply to those designs. Under the revised certification standards, new 
transport aircraft designs must incorporate one of three methods to detect icing 
and to activate the airframe ice protection system: 


e An ice detection system that automatically activates or alerts pilots to turn on 
the ice protection system. 


e A definition of visual signs of ice buildup on a specified surface (e.g., wings) 
combined with an advisory system to alert the pilots to activate the ice 
protection system. 

e The identification of temperature and moisture conditions conducive to 
airframe icing that would alert pilots to activate the ice protection system. 


The new FAA standards further require that, after initial activation, the ice 


protection system must operate continuously, automatically turn on and off, or 
alert the pilots when the system should be cycled. 


FLIGHT DECK HUMAN-MACHINE INTERFACE 


The technology topics discussed to this point have dealt primarily with the 
design aspects of the airplane as a machine and its capability to operate safely in 
the atmospheric environment. This section takes a look at the technology that 
involves the human—machine interface. It involves the flight crew and one or 
more other parties: maintenance, ground operations, weather forecasters, air and 
ground traffic control, and others. In commercial aviation safety matters, it all 
comes together on the flight deck. 

The human-machine interface often becomes a determining factor in the 
event of an emergency, where correct, timely decisions and proper execution 
make the difference between life and death. As discussed earlier in this text, 
human factors is the science that covers the human—machine interface in an 
attempt to maximize the potential for safe, efficient operation while eliminating 
hazardous conditions resulting from human error. 

Technology on flight decks has improved continuously since the early days of 
aviation. Notable advancements are radio communication, radio and inertial 
navigation, and approach systems. The jet engine greatly simplified cockpit 
controls and displays. The following are some of the flight deck technology 
changes that have made a significant contribution to improving safety: 


e Crew alerting and monitoring systems 

e Simple system designs 

e Redundant systems 

e Automated systems (when essential) 

e Moving Map displays 

e Engine-indicating and crew-alerting system (EICAS) 
e Glass cockpit displays with color enhancement 

e Ground-proximity warning system (GPWS) 

e Traffic Collision Avoidance System (TCAS) 

e Aircraft Communications Addressing and Reporting System (ACARS) 
e Flight management system (FMS) 

e Head-up display (HUD) 


EARLY FLIGHT DECK DEVELOPMENT 


The Boeing 707, Boeing 727, DC-8, early Boeing 747, DC-10, and L-1011 flight 
decks used a standard three crew arrangement consisting of a captain, first 


officer, and flight engineer. Much like the previous aircraft, the airplane systems 
were designed for the flight engineer to be the systems operator. Large 
instrument panels were mounted behind and to the right of the two pilots. The 
flight engineer was also expected to monitor and operate the vital hydraulic, 
electrical, fuel, air conditioning, and pressurization systems with minimal 
supervision. The design of the short-range Boeing 737 was changed radically to 
provide a flight deck that only needed a two-person flight crew. 

To accomplish this crew reduction, the airplane systems were first simplified. 
The fuel system, for instance, now only has three tanks: a right-wing tank for the 
right engine, a left-wing tank for the left engine, and a center tank to be used by 
both engines. The fuel boost pump capacity, line sizes, and fuel head were 
designed to permit fuel from the center tank to be used first, followed by wing 
fuel, without any crew action following the prestart checklist. When the center 
fuel is depleted, amber lights annunciate to the crew to inform them that the 
center tank pumps can be turned off. A cross-feed system is provided for non- 
normal operations. This simplified system has other benefits besides crew 
workload reduction. 

Multiple sources of power or supply are provided on all systems to ensure 
adequate system function when one or more elements has failed. Multiple 
hydraulic pumps are also provided, driven in different ways to provide a 
completely redundant system. 

The control system on the Boeing 727 uses cables from the control column to 
hydraulic actuators for normal operations. However, if the two hydraulic systems 
fail, a system of cables to the flight controls provides a manual reversion method 
of controlling the aircraft. The Boeing 757 is a newer-generation aircraft and 
takes a different approach to redundancy. It has three hydraulic systems, an 
engine pump, an electrical pump, and a ram air turbine as a backup system. This 
replaced the direct cable-to-control connection. The Boeing 747 is similar, with 
four hydraulic systems and no direct cable-to-control connection. At least one 
hydraulic system and pump must be operating to move the flight controls. The 
Airbus A-320 also requires at least one hydraulic system and pump to move 
flight controls. The A-320’s redundancies include three hydraulic systems, two 
engine-driven pumps, two electric pumps, a power transfer unit (uses one 
hydraulic system to pressurize another), and a ram air turbine in case alternating 
current electric power is lost. 

Automatic operation of a system was also provided for selected equipment 
failure cases to avoid the necessity of crew intervention at a critical time in 
flight. The Boeing 737 electrical system load-shedding feature is an example. In 
the event of a single generator failure on the two-generator nonparalleled 


electrical system, the remaining generator picks up the essential load, and 
nonessential loads are shed. The galley power and other similar loads are shed so 
that the remaining generator can provide all essential electrical loads without the 
need for crew attention or intervention. Later, when the crew has time to restore 
a second generator, the shed loads can be recalled. This same design philosophy 
has prevailed through the other two-crew designs on the Boeing 757, Boeing 
767, and Boeing 747-400 aircraft. 


FLIGHT DECK: BOEING 757/767 AND BOEING 747-400 


Flight deck noise levels are low enough today to allow a true “headsets off” 
environment for the pilots. While the forward windshields are flat for best 
optical characteristics, the side windows are curved to prevent turbulent airflow 
and reduce the associated aerodynamic noise. Wind-tunnel studies showed that 
the aerodynamic vortex created by the sharp angular change between the flat 
forward and flat number-two windows contributed to cockpit noise levels at 
cruise airspeeds. This source of noise has been eliminated in the Boeing 757/767 
flight deck. The air-conditioning system is designed to further reduce flight deck 
noise by means of ducting improvements and lower airflow velocities. 

Vision characteristics are excellent inside and outside the Boeing 757/767. 
Vision through the windshields exceeds Society of Automotive Engineers (SAE) 
recommendations, allowing pilots superior collision avoidance capabilities when 
visually clearing for traffic. Also, improved downward visibility and maintaining 
a low deck-approach angle combine to give an extra margin of safety when 
landing in adverse weather conditions. 

In this “quiet and dark” flight deck, few green or blue lights indicating normal 
system operation are used. Lighted pushbutton switches that combine the amber 
malfunction light with the shutoff switch are used to reduce the possibility of 
incorrect crew action. 

The integrated display system (IDS) in the Boeing 747-400 consists of six 8- 
inch square screens. Although all are identical, each performs a different 
function depending on its location: 


e Primary flight display (PFD) 
e Navigation display (ND) 
e Engine indication and crew-alerting system (EICAS) 


The two outboard cathode ray tubes directly in front of the pilots function as 
the cantain’s and first officer’s nrimarv flight disnlavs (PFDs). Each nilot can 
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use the PFD as the single source for all the primary flight instruments found on a 
traditional instrument panel. The tape formats used for altitude, airspeed, and 
heading/track indications were chosen for two reasons: (1) they permit sufficient 
display resolution without disrupting the “basic T” instrument configuration; (2) 
the tape formats more readily accommodate related supplemental information. 
This information, such as speed bugs and a trend vector, increases pilot 
situational awareness. 


AUTOMATION 


Automation has touched so many facets of today’s society. The impacts of 
automated systems are very visible in the aviation sector. For example, on the 
modern flight deck, automation provides pilots with information such as how 
much fuel will be available at the destination and where the top of a climb is in 
order to optimize the flight path and takes care of many functions that were 
previously accomplished by the pilot, such as calculation of takeoff and 
approach speeds. Although automation has solved many problems and reduced 
some types of workload, it is also causing new and different types of aviation 
safety challenges. 

Automation is beneficial because it can greatly aid human decision making. 
Two main points have led to the adoption of automation on board: the desire to 
reduce human error and the desire to enhance efficiency for better economic 
performance. Although humans are prone to making mistakes, with the help of 
computer-based algorithmic processes, the pros and cons of each situation can be 
based on facts and logic instead of other human intuition and deduction. 
Additionally, as the airline industry continues to grow at a fast pace, automation 
helps train pilots and allows them to operate aircraft at maximum economic 
efficiency, such as using autoflight systems that result in fuel savings. 

In the right setting, automation can increase capacity and productivity, reduce 
manual workload, and provide precise handing of routine operations. Some 
items that help achieve this are multifunction displays (MFDs), autopilots, auto- 
throttles, digital flight guidance panels, and FMS. MFDs provide numerous 
types of information to a pilot, depicting items such as location, system status, 
and even checklist steps. Having such information immediately available can 
reduce workload, which leaves more time for thinking and making decisions. 
Automatic flight systems, such as auto-throttles and the autopilot, can 
significantly reduce pilot workload and thus prevent pilot fatigue. FMSs are 
specialized computers that automate several in-flight tasks, such as managing the 


flight plan and estimating fuel burn and times at different navigation waypoints. 
These automated tools used by a proficient pilot can greatly help to manage 
workload, and thus, allow pilots to focus their mental abilities on items such as 
planning ahead and retaining situation awareness. 

However, there can be a dark side to automation. The CEO of Microsoft, Bill 
Gates, purportedly once said, “Automation applied to an efficient operation will 
magnify the efficiency, but automation applied to an inefficient operation will 
magnify the inefficiency.” Furthermore, in addition to becoming competent at 
flying the aircraft, modern pilots must also achieve a high degree of proficiency 
in operating and supervising the automated systems. Learning how to operate 
different components takes time, and building the proper memory to efficiently 
actuate components takes even more time. A single knob can have different 
functions depending on how you actuate the knob and can also mask your 
intentions from the other pilot on the flight deck. Figure 8-3 shows a pilot 
reaching for a knob on the flight guidance panel of an Airbus. Pilots who do not 
understand automation fully can easily expect one type of automated operation 
to occur but then be surprised by what actually occurs, a concept known as 
automation surprise. 


FIGURE 8-3 Pilots are taught to look for an output to an input, meaning that the pictured pilot may be 
moving a heading knob but looking at a flight display instead of the knob to see the actual output of the 
change. (Source: Authors) 


Since human error is the source of many accidents, it has driven the safety 
philosophy behind adding more onboard automation, but human error associated 
with designing and then using automation must also be considered. It may seem 
to make sense to eliminate the human from operations, and therefore prevent 
accidents because of no human error, but humans are always involved in 
everything, including autonomous unmanned aerial vehicles. After all, people 
design unmanned aircraft, repair them, and oversee their operation. Errors can be 
introduced at any point in the cycle. Automation design philosophies need to 
consider striking the right balance between automation and humans because the 
two are complementary factors for providing flight safety. 

These are challenging safety areas since accidents from human error in 
automation can be as inadvertent as a typo in a document. Many automation 
functions rely on a data-in, data-out structure. The output produced by the 
automation is directly tied to the input provided by the operator. The concept 


that erroneous data input will produce inaccurate outputs is sometimes referred 
to by the expression garbage in, garbage out. Even a miniscule error could 
potentially cause a whole system to fail. To address such high stakes, some 
pilots treat data entry as a sterile operation, meaning that crew working on any 
type of data entry should not have distractions such as nonpertinent 
conversations with other crewmembers during the data entry operation. Their 
attention should be solely devoted to their work to prevent them from making 
inadvertent errors. 

Emirates Flight 407 is an example of how the entry of a wrong number can 
have a huge impact. In 2009, the crew of Flight 407 narrowly avoided a crash 
during takeoff from Melbourne, Australia after someone accidently typed the 
weight of the plane as 262.9 tons, instead of 362.9 tons, thus resulting in the 
inaccurate calculation of the takeoff speed. As a result, the aircraft failed to 
climb once airborne and hit structures at the end of the runway before managing 
to gain altitude and return for a safe landing. The future of automation training 
should include novel concepts such as the idea of no secret typing, meaning that 
all key data inputs into automation must be cross-checked by both pilots. 

Future safety improvements to the design of automation for flight deck use 
will require successful adoption of basic safety principles. First, there should be 
procedures and checklists that are an extension of company philosophy and 
operating procedures for the correct amount of automation to use in different 
flight situations. These items can help users know what to do, for example, in the 
event of an automation failure. Second, aircrew should rely on training and 
experience to identify a correct course of action in the event of abnormal or 
emergency situations. They should be able to make these decisions independent 
of automation in the case they need to rely on basic aviation principles. 
Similarly, pilots should work to retain basic hand-flying skills so they can still 
safely operate the aircraft if an automated system fails. 


NEW FLIGHT DECK ENHANCEMENTS 


Aircraft manufacturers strive to continuously improve human—machine 
interfaces, such as evidenced with the Boeing 777 and its new Boeing 787 
“Dreamliner” aircraft. The layout of the Boeing 777 flight deck is similar to the 
Boeing 747-400 and has the following systems: 


e Glass cockpit, three axis digital fly-by-wire flight control system. 
e Flight, navigational, and engine information is presented on six large display 


screens with advanced liquid crystal display (LCD) technology. 


An integrated Airplane Information Management System which provides 
flight crews information regarding the overall condition of the aircraft, 
maintenance requirements, and key operating functions. 

Ground maneuver camera system with video views of the nose and main 
landing gear to assist the pilot with ground handling when maneuvering at the 
gate area. 


The Boeing 787 “Dreamliner” retains operational similarity with the B-777, 


including fly-by-wire with a control yoke, and has the following systems: 


The display screens are twice as large as the B-777, providing additional 
situation awareness to the flight crew. An avionics full-duplex switched 
Ethernet is used to transmit data between the flight deck and aircraft systems. 


New dual HUDs which allow the pilots to view critical flight data on a 
transparent display looking forward through the windscreen instead of down 
into the instrument panel. 

New dual electronic flight bags (EFBs) which are the digital equivalent of the 
bulky pilot’s flight bag. This includes all maps, charts, manuals, and other 
data for the “paperless cockpit.” 

New electrical architecture which replaces bleed air and hydraulic power 
sources with electrically powered compressors and pumps. This improvement 
saves weight and enhances efficiency. 


Competition between Boeing and Airbus remains high for new aircraft orders. 
The Airbus A-380 flight deck uses a similar layout to other Airbus aircraft 


and has the following systems: 


Improved glass cockpit and fly-by-wire flight controls linked to sidesticks as 
in the past, with improved LCD cockpit displays. 


Two primary flight displays (PFDs) dedicated to critical flight information, 
and two MFDs which display navigation route, moving map, weather, and 
other information. These MFDs are new to the A-380, providing an easy to 
use interface with the FMS. 

Similar to the Boeing 787, the A-380 uses an integrated modular avionics 
system with a full duplex switched Ethernet to transfer data to the aircraft 
systems. 

The EFB, which is essentially a means for producing a paperless cockpit, is 


called a network systems server which stores data such as equipment lists, 
navigation charts, performance calculations, and the aircraft logbook. 


The Airbus A-350 is the latest European aircraft following in the wake of the 
super jumbo A-380 development. Its flight deck has the following 
enhancements: 


e Large LCD screens with two central displays, a single primary flight and 
navigation display with an onboard information screen, plus a HUD on the 
windscreen. 


e The A-350’s integrated modular avionics system manages many additional 
critical aircraft functions such as the landing gear, fuel, brakes, pneumatics, 
cabin pressurization, and fire detections systems. 


CREW ALERTING SYSTEMS 


The Boeing 737 introduced a very simple but elegant and effective crew monitor 
and alerting system. Almost all of the airplane’s system controls are located 
overhead and are outside the normal line of sight of the two pilots. When all 
systems are “on” and operating, no caution lights are observed. In the event of 
loss of equipment, an amber light annunciates the condition on the overhead 
panel. The loss is also repeated on master caution lights on the glare shield in 
front of each crewmember and in small caution panels also on the glare shield. 
The panel annunciation identifies the system affected and the location of the 
system controls overhead. 

Since this was a new scheme at the time of certification, it got a lot of 
attention by the certification authorities and designers. To make sure that 
airplane system operation was not an inordinate burden and did not substantially 
increase workload for the flight crew, many hours were spent in the simulator 
and during certification flight testing to measure the time spent on airplane 
subsystem operation. The result of such attention workload is that less than 1% 
of the crew’s time from takeoff to landing is spent on system operation, 
including during the deliberate equipment malfunctions that were simulated by 
the certifying agency. This careful attention to system detail design and 
improvements in monitoring capability has been used for virtually all jet models 
subsequent to the Boeing 737. 


GROUND-PROXIMITY WARNING SYSTEM. Since the advent of powered flight, 
inadvertent ground or water contact has been a worldwide problem. While much 


early effort went into avoiding such accidents, no major advance occurred until 
introduction of the ground-proximity warning system (GPWS) in the early 
1970s. Although there has been a marked reduction in controlled flight into 
terrain (CFIT) accidents since then, they still occur with distressing frequency 
and have accounted for up to 75% of worldwide fatalities on commercial 
transports. For the air carrier fleet, there are two primary reasons CFIT accidents 
occur: either (1) the airplane did not have GPWS (or it was inoperative) or (2) 
the crew received the appropriate GPWS alert but chose to ignore the alert. The 
Flight Safety Foundation (FSF), along with others, has an aggressive program to 
essentially eliminate CFIT accidents. 

The Enhanced GPWS, termed EGPWS, is an advanced terrain warning 
system used in most modern commercial airline fleets. The EGPWS improves 
situation awareness and increases warning times by using a terrain database that 
compares actual location of the aircraft to terrain in the database and uses a 
“look ahead” feature to detect what terrain ahead of the flight path may pose a 
risk. 


TRAFFIC COLLISION AVOIDANCE SYSTEM (TCAS). This is an electronic aircraft 
collision warning system to help prevent dangerous midair collision accidents, 
which as one might imagine are often associated with great loss of life. 
Typically, TCAS requires mutual “Mode S” transponder technology which 
automatically communicates with other aircraft independent of ATC systems to 
display the relative position of other such transponder equipped aircraft. Upon 
detecting an intruder aircraft, TCAS issues a traffic advisory or resolution 
advisory to the flight crew to climb or descend as necessary to avoid the other 
aircraft. The latest version of the system is TCAS II, Version 7.1, which has 
been endorsed by ICAO and several leading regulatory agencies. 
Implementation of this improved TCAS version is underway and provides 
enhancements such as the reversal of issued instructions in case one of the 
aircraft does not follow the originally issued instructions. 


ENGINE-INDICATING AND CREW-ALERTING SYSTEM. The engine-indicating and 
crew-alerting system (EICAS, or ECAM for Airbus aircraft) is a digital 
computer system which monitors and indicates propulsion and airplane 
subsystem information for the operation and maintenance of the airplane. 
EICAS/ECAM interfaces with many airplane components and subsystems. 
Discrete inputs are implemented in a hierarchy that reflects operational and 
maintenance requirements: 


e Flight crew alert messages duplicate dedicated subsystem information 
(usually indicator lights) elsewhere in the flight deck. 

e Status and maintenance messages provide lower priority information on the 
condition of many subsystem components. 


New Airbus and Boeing aircraft models have improved EICAS/ECAM to 
enhance functionality and reduce display footprint on the flight deck. Each 
manufacturer has its own strategies for engine indications and crew alerts, but all 
perform essentially the same basic functions. 


AIRCRAFT COMMUNICATIONS ADDRESSING AND REPORTING SYSTEM 


The Aircraft Communications Addressing and Reporting System (ACARS) is a 
communication datalink system that sends messages, using digital technology, 
between an airplane and the airline ground base. The operational features of 
ACARS equipment and the ways in which ACARS is used in service vary 
widely from airline to airline. 

There is nothing new about sending messages between the airplane and the 
ground. What makes ACARS unique is that messages can be sent, including fuel 
quantity, subsystem faults, and air traffic clearances, in a fraction of the time it 
takes using voice communications, in many cases without involving the flight 
crew. 

The Aircraft Communications Addressing and Reporting System relieves the 
crew of having to send many of the routine voice radio messages by instead 
downlinking preformatted messages at specific times in the flight. These may 
include the time the airplane left the gate, liftoff time, touchdown time, and time 
of arrival at the gate. In addition, ACARS can be asked by the airline ground 
operations base to collect data from airplane systems and downlink the requested 
information to the ground. 

Each ACARS message is compressed and takes about 1 second of air time to 
transmit. Because of the automatic reporting functions described above, the 
number of radio frequency changes that flight crews must make is reduced on 
ACARS equipped airplanes. Sending and receiving data over the ACARS 
network reduce the number of voice contacts required on any one flight, thereby 
reducing communication workload errors and costs. Such messages were 
previously transmitted via voice by one of the pilots and often occurred during 
very inopportune moments of high workload. 

The accurate reporting of event times, engine information, crew 
identification, and passenger requirements provides for a close control of any 


particular flight. Airplane system data, such as engine performance reports, can 
be sent to the ground on a preprogrammed schedule, or personnel on the ground 
may request data at any time during the flight. This allows ground personnel to 
observe the engines and systems and can alert them to problems to be 
investigated. 

Improvements in ACARS technology have been implemented in 
approximately 2,000 aircraft to transmit ACARS messages and data 
communications from air traffic controllers known as Controller Pilot Data Link 
Communications (CPDLC). Voice communications are easily misunderstood, 
and voice frequencies are easily overloaded. CPDLC was proposed by FAA as a 
new Strategy to cope with the increased demands on ATC and has proven very 
effective and efficient during operations in busy en route airspace. 


FLIGHT MANAGEMENT SYSTEM 


The flight management system (FMS) is an integration of four major systems: the 
flight management computer system (FMCS), the digital flight control system 
(DFCS), the auto-throttle (A/T), and the inertial reference system (IRS). The 
basic functions of the FMS are as follows: 


e Automatic flight control 
e Performance management 


e Precision navigation 
e System monitoring 


The FMS is designed to allow crew access to the total range of aircraft 
performance, navigation, and advisory data computation capability at any time 
and in any flight control mode. For example, when the airplane is under manual 
control, the pilots, at their option, can get flight optimization data from the flight 
management computer and appropriate target airspeeds. 

The flight management computer is a major innovation in the FMS design. In 
addition to navigation, it performs real-time, fully automatic performance 
optimization and can control the airplane through the flight control system, 
including the auto-throttle. While crews currently determine the most efficient 
speed and altitude by using the flight operations manuals and calculators, this 
function is usually performed only periodically. Further, because it is a digital 
system, the software and programmable databases in the FMS provide the 
adaptability and growth needed for present and future airline operations, 
particularlv as navigation and ATC svstems evolve. 


MULTIPLE FLIGHT CONTROL COMPUTERS 


On the newer-generation aircraft, elevator/aileron computers (ELACs) have 
primary control of elevators and ailerons and perform the computations for 
spoilers and yaw damping. One ELAC is active while the other is a backup. 

Spoiler/elevator computers (SECs) provide primary control of spoilers. If 
both ELACs fail, the SECs also provide backup control of roll and pitch via 
spoilers and elevator. 

Flight augmentation computers (FACs) control rudder for turn coordination 
and yaw damping. They also compute limits for the flight envelope, wind shear, 
and speed information displayed on the primary flight display. 

Multiple, redundant computer flight control systems ensure that no single 
failure of an electrical, hydraulic, or flight control component will result in a 
reduction in operational capability. 


CENTRAL MAINTENANCE COMPUTER SYSTEM 


One technology that is able to assist in ensuring the operational status of 
complex systems is the central maintenance computer system (CMCS). This 
technology can collect, display, and provide reports of fault information and test 
airplane systems. It provides ground maintenance personnel with a centralized 
location for both testing and access to maintenance data. The net result is a 
decrease in airplane turnaround time and an increase in dispatch reliability over 
previous-generation airplanes. 

The CMCS was developed to monitor and troubleshoot the complex and 
integrated systems on the Boeing 747-400. It was also created to centralize 
ground testing, fault information storage, and real-time data monitoring. In 
previous-generation airplanes, testing, troubleshooting, and fault isolation were 
confined to a system-by-system approach, and faults that affect multiple systems 
were often difficult to isolate. Because so many systems on the Boeing 747-400 
are interdependent, a fault in a single system can ripple through several other 
systems. Since the CMCS is linked to all major systems, it can provide 
simultaneous fault monitoring for related systems and can reduce multiple fault 
indications to a single fault. 

The latest Airbus system for real-time aircraft maintenance is known as 
AlRcraft Maintenance ANalysis (AIRMAN), which is an intelligent software 
system designed to optimize maintenance and minimize aircraft turnaround time 


on the ground. AIRMAN constantly monitors the health of the system, tracks 
maintenance that has occurred on the aircraft, and has the clever feature of 
prioritizing troubleshooting steps by likelihood of success. 


MODELING, DESIGN, AND TESTING TOOLS 


Airplane design and technological progress seen in this century could not have 
happened without parallel advancements in computing capability. This was no 
coincidence, for in many cases, computer science was trying to solve airplane 
technology problems. Major breakthroughs for the computer (and all avionics 
for that matter) were the vacuum tube, the transistor, and the microprocessor. 

The computer advancements made to date are what enabled not only all the 
onboard and support avionics systems but also all the analysis and testing that go 
into them. It is not possible to cover all this technological progress, as it has been 
explosive on all fronts. The important part of incorporating any technology is to 
first make sure it has been analyzed and tested thoroughly. Some of the 
technologies that have made contributions to commercial aviation safety are 
discussed next. 


COMPUTATIONAL FLUID Dynamics (CFD) 


Computational fluid dynamics (CFD) methods have been used extensively in the 
design of all new-generation aircraft. Advances in supercomputing technology 
over the years have allowed CFD to solve problems of greater relevance to 
aircraft design. Use of these methods allowed a more thorough aerodynamic 
design earlier in the development process, allowing greater concentration on 
related operational and safety-related features. 


WING DESIGN. The ability of CFD to do the inverse problem, meaning to 
determine an optimal geometric shape in order to achieve a desired flow, 
revolutionized the transport wing design process. Since the Wright brothers, 
wing design had been a “cut and try” operation, which is an expression more 
widely referred to as a trial and error approach. The “try” would take place in the 
wind tunnel or in flight. The advent of sufficiently powerful computational 
methods allowed some of the try to be shifted to the computer. The “cut” was the 
designer shaping the wing based on experience and intuition. CFD allows a new 
approach in which the design engineer specifies to the computer the 
aerodynamic pressures desired on the wing, and the CFD code computes the 
geometric contouring of the wing surface that will produce those pressures. The 


engineer does all the design works, the initial evaluation with CFD, then picks 
the best candidates, and then builds the best wind-tunnel models to test the new 
design. 

This inverse design technique was first used in the development of the Boeing 
777, which sets a new standard for all future aircraft to follow, allowing 
achievement of a level of aerodynamic performance not otherwise possible in a 
time-constrained development program. The CFD methods used for this 
application were based on nonlinear potential equations coupled with boundary- 
layer equations to account for viscous effects. The key to this use of CFD was 
the ability to model enough relevant physics and gain quick turnaround from 
initial geometry to a completed solution. The resulting wing designs are thicker 
and lighter than their previous counterparts. These characteristics allow wings 
with greater span or less sweepback. Both features are conducive to better low- 
speed (landing and takeoff) performance, improved safety margins, and reduced 
aircraft noise. 

Today, CFD is being used to better address the diverse requirements for 
nacelle design for cruise, engine-out second-segment climb, and engine-out 
extended-range twin-engine operations (ETOPS). Nacelle design is being 
optimized to minimize drag at cruise conditions and provide acceptable engine- 
out drag for second-segment climb and ETOPS. Engine-out drag is not the only 
criterion of merit. If external flow separation occurs, the separation wake could 
impinge on other aircraft components, causing premature buffeting of the 
aircraft, perhaps indicating to the pilot that the aircraft is approaching stall 
conditions. If it is severe enough, the pilot might be inclined to reduce the angle 
of attack—a situation not desired during takeoff or climbout. CFD has become a 
very valuable tool for the designer to provide additional safety benefits that 
might not otherwise have been feasible. 


WIND-TUNNEL BENEFITS 


Today, wind-tunnel testing complements the computational fluid dynamics tools, 
which focus efforts to a narrowed field of configuration options. During 
development of the Boeing 767 in the late 1970s, the manufacturer conducted 
tests in 15 tunnels in four countries for more than 20,000 hours, conducting 
100,000 data runs. Each run consisted of recording an average of 65 independent 
parameters at approximately 25 different aircraft attitudes. In that Boeing 767 
program, more than 100 variations of the wing design and untold numbers of 
different flap and slat positions were tested. Despite intensive use of CFD, the 
test program for the Boeing 777 involved about 20,000 hours of wind-tunnel 


testing up to the first flight. 

The value of wind-tunnel testing goes beyond optimization of wing designs 
and performance. The results contribute to information about safety involving 
load determination for structural design, simulator database development, 
stability and control characteristics for both normal and failed configurations, 
and aircraft anti-icing control. The effective and efficient integration of 
propulsion systems onto the airframe is served, in part, by powered models that 
provide simulations of installed engines’ flow fields. 


FLIGHT SIMULATION 


The flight simulator was recognized very early as a valuable tool in improving 
aircraft safety. It owes a lot to the pioneering efforts of Ed Link. Early in the 
initial transition of crews from props to jets, a number of training accidents 
occurred, particularly during engine-out training. It endangered not only those in 
the airplane but also those on the ground. The technology that allowed this 
hazardous training to occur in a simulated environment on the ground was a 
great benefit to flight safety. 

Development of the simulator took two parallel paths, one for engineering 
evaluation and the other for flight training. Each benefited the other. The 
engineering simulation allowed the engineer and the test pilot to evaluate design 
options during design and to define the best operating procedures. It has also 
been used to evaluate accident and incident data to better understand what might 
have gone wrong and to find solutions. 

At first, simulators were very crude. The engineering simulators were analog 
and could fly the initialized flight condition on instruments only. Later, a model 
board was constructed to represent a bird’s-eye view of a large ground area 
using a miniature TV camera and closed-circuit TV that “flew” over the 
landscape model to provide an accurate view out of the cockpit window. This 
feature greatly improved the evaluations that one could perform, but it had 
limitations. Computer-generated imagery (CGI) was the real breakthrough. It 
allowed weather and a variety of airports to be evaluated. This technology 
continues to advance and is providing more and more realism with full flight 
simulators featuring three-axis motion platforms and 360-degree, outside-world 
visual projections. 


FLIGHT TEST 


The ultimate test of an airplane before it enters active service is when it goes 


through flight testing and is subjected to the real-world environment. Flight 
testing has had to advance in four areas to keep pace with the jet airplane’s 
advanced performance, expanded flight envelope, and the advanced technology 
incorporated into the airplane systems. These four areas include the following: 


1. New flight-test techniques 

2. Improved accuracy of instrumentation 
3. Improved data-recording systems 

4. Real-time monitoring and data analysis 


These advances have made it possible to conduct increasingly accurate and 
thorough tests to ensure that the airplane is ready for service. Typical of such 
tests is the takeoff minimum unstick speed, abbreviated Vņy, which is the 


minimum airspeed at which an airplane can safely lift off the ground and 
continue takeoff. This test demonstrates the takeoff performance margin existing 
at unstick (takeoff) speed, ensuring that the airplane will not encounter a 
hazardous condition such as loss of control or failure to accelerate. This is one of 
the key tests to ensure that engine thrust is maintained; the control and flap 
systems function as designed; and control and flap systems provide the airplane 
with the low-speed, high-angle-of-attack controllability needed for safe 
operation. This test is also used to establish required operational parameters for 
takeoff field length. Flight tests such as this one have greatly contributed to the 
safety of the commercial airplane. 


ACCIDENT/INCIDENT INVESTIGATION 


The industry has always devoted a lot of effort to the technologies involved in 
finding causes of incidents and accidents. The flight data recorder (FDR) and 
cockpit voice recorder (CVR) are indispensable tools in this task. 

Substantial progress was made during 1987 in the NTSB’s goal of persuading 
the FAA to require more and better cockpit voice recorders and flight data 
recorders aboard aircraft. However, efforts by the NTSB to upgrade 
requirements for the use of FDRs and CVRs to take advantage of newly 
available technology have often faced a long, uphill battle. Over the years, the 
NTSB had difficulty persuading the FAA to improve recorders on larger 
commercial jets and expand their use on commuter and some corporate aircraft, 
despite the proven value of recorders as a vital tool in accident investigations. 

The FAA had issued a notice of proposed rulemaking to upgrade recorder 
requirements but failed to act on it for more than 2 vears, despite NTSB 


prodding. On March 25, 1987, however, the Secretary of Transportation 
announced a requirement for installation of CVRs on newly manufactured turbo 
propeller commuter aircraft carrying six passengers or more and having two 
pilots. The Secretary also called for installation of digital flight data recorders on 
older jet aircraft, replacing the foil-type versions then required. The 
announcement came after a commuter plane accident at Detroit Metro Airport on 
March 4 of that year, which dramatically helped focus congressional and public 
attention on the stalled flight recorder rulemaking. Just 2 weeks after the 
accident, a congressional panel approved report language directing the FAA to 
“take immediate steps to require the installation of CVR and FDR devices on all 
commuter aircraft in line with NTSB recommendations.” 

The number of FDR data channels and the crashworthiness of these vitally 
important records have increased significantly. The early generation of FDRs 
only recorded time, altitude, airspeed, vertical acceleration, heading, and the 
radio transmission event marker. The number of parameters has now increased 
so that today, with all-digital avionics systems onboard the new airplanes, a 
more detailed record can be made and stored for a longer time. This area is 
another way in which digital avionics contributes to aircraft safety. 

The Boeing 787 Dreamliner is the first aircraft equipped with enhanced 
airborne flight recorders (EAFRs), a combined cockpit voice and flight data 
recorder (CVR/FDR) with crash protected memory, and the capability to record 
datalink messages and cockpit imagery. In 2002, the NTSB added crash 
protected image recorders to its Aviation Most Wanted Safety Improvement List 
of items needing urgent attention by the FAA; therefore, development of cockpit 
image recorders will be a future issue in the area of accident investigation. 


CONTROL STRATEGIES TO MANAGE THREATS AND 
ERRORS 


Effective control strategies to manage threats and errors include engineering- 
based tools associated with the aircraft such as cockpit automation, instrument 
displays, or warning devices. For example, the GPWS is a so-called “hard” 
defense mechanism to prevent controlled flight into terrain with visual and audio 
warnings to “pull up.” A yoke “stick shaker” or stall warning horn would be 
another example of an engineering control strategy to warn pilots of low air 
speed and possible stall situation. 

There are other control strategies which are more administrative in nature. 
The so-called “soft” defenses such as checklists, rules and regulations, standard 


operating procedures, etc., are used to direct crewmembers to take appropriate 
action under a given set of circumstances. Using CRM, LOSA, and Threat-and- 
Error Management (TEM) training concepts, modern airline crews are now 
taught the newest techniques and communication skills to avoid the human error 
entirely; trap it from spreading into an undesired aircraft state; or finally, 
mitigate the consequences of the error through anticipation, error recognition, 
and ultimate recovery from the undesirable human error problem. 


AIRBUS AND BOEING DESIGN STRATEGIES 


With the rapid growth in microprocessor technology in the past three decades 
there has been a temptation on the part of some designers to build very complex 
systems based on the rationale that the systems could operate automatically. 
There are two major fallacies in this argument. First, almost no major system on 
an aircraft truly operates fully automatically. Systems must be initialized or set 
up by the human, decisions about operating modes must be made, and then the 
systems must be monitored by humans for obvious reasons. Second, in the event 
of the failure of automation, it always falls to the human to operate the system. 
This responsibility cannot be avoided or designed away. If the complexity of the 
system is unbridled, then the crew may not be able to perform their duties 
effectively or take over in the event of equipment failure. 

In response, many design engineers with human factors sophistication have 
recognized that simplification offers an attractive alternative to automation. If 
the system can be simplified, there may be no need for complex automation, and 
the same goal can be achieved without placing the human in a potentially 
hazardous position. An example is the fuel system on a multiengine aircraft. 
Those favoring automation would find no problem with creating a complex tank- 
to-tank and tank-to-engine relationship, as long as its management could be 
automated. If, for example, a fuel imbalance were created, automatic devices 
would detect the imbalance, determine a remedy, open the required transfer 
valves, and turn on the appropriate pumps to restore the proper balance. No 
human intervention would be required. 

This example represents a philosophical difference between two major 
aircraft manufacturers—Airbus and Boeing, as previously expressed in the 
chapter. The Airbus general approach has been to remove the pilot from the loop 
and turn certain functions over to sophisticated automation. Aircraft compliance 
with the input is automatic—the computer systems do not ask for the crew’s 
approval. Boeing’s approach, however, is never to bypass the crew: 
Sophisticated devices inform the crew of a need and, in some cases, a step-by- 


step procedure; but in the end, it is the crew who must authorize and conduct the 
procedure. Boeing is a strong advocate of simplification before automation. 
Their designers would look to a less complex relationship. An example would be 
fewer tanks to feed the engines, creating fewer tank-to-tank and tank-to-engine 
requirements, requiring less management by the crew and fewer opportunities 
for human error. 

One of the potential difficulties with highly automated systems is that 
onboard computers may, unknown to the crew, automatically compensate for 
abnormal events. Efficient automatic reaction to abnormal events and conditions 
sounds attractive, but there is always a limit to the system’s capacity to 
compensate. When automation is reacting to a worsening condition without the 
crew’s knowledge, this can lead to a situation where it may be too late for the 
crew to override the system and thus prevent a catastrophe,—hence our theme to 
Chapter 4, “Humans as the Solution.” 


FLIGHT DECK STANDARDIZATION 


It is desirable to ensure that the automation and systems operated by pilots are 
relatively similar between different types of aircraft in a given airline. Doing so 
reduces training costs and prevents negative transfer of habit patters as pilots 
transfer between aircraft types during a career. Maintenance costs are also 
reduced from such an approach. During periods of rapid expansion of aircraft 
inventories and pilot personnel, there is frequent movement between aircraft as 
pilots bid for more lucrative or convenient assignments, more modern aircraft, or 
more desirable bases. Some airline labor contracts limit the rapidity with which 
pilots may bid a new seat; others do not. 

Most flight deck hardware is peculiar to the type of aircraft. However, certain 
flight deck hardware could be common to most or all models operated by a 
carrier; examples are radios, flight directors, certain displays, area navigation 
equipment, and weather radar. Other examples would be devices added after the 
original manufacture (e.g., TCAS, ACARS). When the carrier has the 
opportunity to purchase these add-on units, a common model will most likely be 
chosen for all the reasons stated above. 

Where differences already exist between fleets, the airline may intervene by 
standardizing procedures throughout the airline. For example, some airlines have 
invested in a common airline-wide model of the flight director, which is a type 
of automated information presentation for pilots to help with precise aircraft 
control. 

Between-fleet standardization, if it involves retrofit rather than new 


equipment purchase, will be extremely costly and its safety benefits may be 
modest compared to within-fleet standardization. Nonetheless, when pilots move 
rapidly through the seats of various aircraft or complete training for one aircraft 
and then return to another while awaiting assignment to the new aircraft, fleet 
standardization of flight deck hardware deserves inclusion in the list of 
intervention strategies against human error. 

Within-fleet standardization is a far more critical issue. Long before the 
Airline Deregulation Act of 1978, carriers purchased aircraft from one another, 
thus generating mixed aircraft configurations within fleets. With the coming of 
deregulation, the pace of mergers and acquisitions, as well as used equipment 
purchases and leases accelerated rapidly causing a safety issue regarding flight 
deck configuration. These differences included different displays (e.g., various 
models of flight directors), warning and alerting systems (e.g., a host of altitude 
warning systems with various trigger points), every imaginable engine 
configuration, controls in different locations, various directions of movement of 
switches, and various operating limitations. One carrier, which had been through 
a number of mergers and acquisitions of other DC-9 operators, had eight 
different models or locations of altitude alerts. It later invested a very 
considerable sum to standardize the flight deck of its DC-9 fleet. Within-fleet 
standardization is considered a high-priority item by line pilots, airline pilot 
unions, and safety committees. Southwest Airlines is a good example of a 
successful flight deck standardization program, focusing on the modern Boeing 
737 as its basic configuration. 


FLIGHT DECK AUTOMATION AND PRECISION NAVIGATION 


In today’s modern commercial aircraft, computer technology and the “glass 
cockpit” have become the norm. Navigation is accomplished electronically on 
moving maps using the latest techniques to enhance the situational awareness of 
the pilot. Nevertheless, as we have learned, the human error element is always 
present and must always be actively monitored by the crew. A good example of 
a human error occurred onboard a Boeing 767 preparing to depart Atlanta for 
Miami. The clearance included TEPEE (note spelling) as a GPS waypoint, 
representing an intersection near Tampa, Florida. The captain entered TEEPE 
(note the different spelling) into the route page of the control display unit 
(CDU). Because there is a TEEPE intersection in Texas, the CDU dutifully 
accepted the erroneous spelling and established it as a waypoint on the route 
from Atlanta to Miami. The sudden shift in course to the west-southwest toward 
TEEPE from the southward course toward TEPEE was immediately evident to 
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the crew. A non-EFIS aircratt with the same GDU FMS (such as some models ot 
the Boeing 737-300) would not have provided this form of error detection 
capability. The crew would have had to detect the error by some other check or 
the hard way when a violation had been issued by an air traffic controller 
noticing the navigational deviation. 

Once the aircraft system properly displays an abnormal condition, there must 
be an effective means of removing it and allowing the system to recover. The 
system must not permit irreversible errors. With traditional aircraft, this was not 
a problem, since working with less sophisticated systems the pilots were closely 
coupled to the machine and they could usually detect and correct an error or 
undesirable system state quite quickly. The advent of highly sophisticated 
automation raises the question of escaping from error and system recovery. 
Generally, the problem is not that the error is irreversible but that a complicated 
recovery process can be difficult, time-consuming, and possibly error-inducing. 

Nevertheless, the modern FMS offers some novel features for protection 
against human error. It can store and process a vast amount of information 
typically contained in manuals, checklists, performance charts, flight plans, 
weather reports, documents, and paperwork of all sorts. This information can be 
displayed to the crew in text, numeric, and graphic forms on selected pages of 
the control display unit, the glass instrument panels, and elsewhere. Some of the 
information is automatically displayed, requiring no request from the crew (e.g., 
the wind vector on the navigation display); other information is available in the 
FMS on demand through pilot selection of the correct CDU page. The display of 
certain valuable information, such as suitable emergency airfields, is switch 
selectable. Finally, if the FMS detects an abnormal computer condition, a brief 
message can be displayed in the “scratch pad” line of the CDU, and the pilot is 
alerted on two other displays that an FMS message is waiting. An example 
would be a request for a waypoint “not in the database.” 

The Boeing 767/757 and the glass cockpit aircraft that followed possessed 
rudimentary forms of computer-based error elimination and protection. The 
Airbus A-320, introduced in 1988, took error protection a step further. The fly- 
by-wire feature offered the opportunity to fly maneuvers, such as maximum safe 
angle of attack (AOA) for wind-shear escape maneuvers, with no danger of 
entering a stall. The computer would simply stop the aircraft’s increase in pitch 
short of its computed safe AOA. If the pilot continued to pull back on the stick, 
no more nose-up pitch would be allowed by the aircraft. An intelligent computer 
interposes an electronic line of defense between the pilot’s control and the 
aircraft’s control surfaces. Incidentally, such a system that has the capability of 
controlling and correcting an error is referred to as an error-resistant or error- 


tolerant system. 

Other EFIS aircraft, such as the Boeing 757/767, offer escape guidance on the 
attitude indicator in the form of a target line for optimal nose-up pitch. In 
contrast with the approach taken in the A-320 design, the pilot always remains in 
the loop in the Boeing aircraft. The pilot controls the pitch angle; the computer 
merely computes and displays the commanded nose-up pitch. 

These two approaches emphasize not only disparate views of cockpit design 
but also basic philosophical design differences previously mentioned in this 
chapter. The Airbus family of aircraft essentially allows the pilot to pull the 
control stick all the way back and let the computer find the maximum angle of 
attack that will avoid a stall. Other EFIS-equipped aircraft depend on the pilot to 
follow the wind-shear escape guidance cues. Each approach has positives and 
negatives, so it is hard to say which approach is more effective. Only time, 
experience, years of accident investigation statistics, and academic studies will 
settle that question. 


NEWER AIRCRAFT TECHNOLOGIES 


The technological opportunities for continued improvement in flight safety are 
as good as ever. The analytical tools, computing capability, simulation, and 
testing capability all far exceed those of the past, and new technologies are 
continuing to unfold. These opportunities are challenging to all engaged in the 
aviation safety community. 

Of all the technologies available for improving safety while providing 
substantial gains for future growth, system capacity, and efficiency, electronic 
technology appears to have the most immediate promise. Accident statistics 
continue to bear out the fact that the aircraft manufacturers need to assist flight 
crews in doing their tasks while improving efficiency of operation. Chip-level 
redundancy combined with fault-tolerant design will provide far greater 
reliability levels for essential and critical functions. Aircraft safety and total 
system capacity and efficiency will undoubtedly be enhanced in the future. 
Boeing and Airbus are already using a number of these features on their next- 
generation aircraft. 


WEATHER DETECTION 


Weather remains a major cause of delays and accidents. Real-time, accurate 
knowledge of the weather ahead is required. Aircraft must be able to detect 
weather conditions: alert the flight crew ta avoid dangerous situations: and 
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effectively cope with turbulence, precipitation, and wind shear. 

Today’s airborne weather radar technology needs improvement, as does the 
training that pilots receive on adjusting radar settings to deliver desired 
information for weather avoidance. Furthermore, the current air carrier fleet is 
often limited to a simple view of weather, and we need a real-time, “big picture” 
integrated display. The future will likely bring advanced airborne weather radar 
with vertical as well as cross-sectional views. Ground and satellite weather 
detection improvements made available on the flight deck will combine to 
enhance flight planning, performance, and safety. 

Onboard system enhancements to aid the pilot in unexpected wind-shear 
encounters are being incorporated on current aircraft. These wind-shear alert and 
guidance systems are being combined with crew training, improved ground- 
based alerting, and weather radar systems. Emphasis is on detection and 
avoidance of hazards occurring along the flight path. If wind shear is 
unavoidable, the wind-shear system quickly alerts the crew and provides pitch 
attitude guidance to effect the most optimal escape maneuver. Improvements are 
also planned to the current ground-based, low-level wind-shear alert system. 
Terminal Doppler weather radars will continue to be installed at critical airports. 


COMMUNICATION AND NAVIGATION SYSTEMS 


As will be discussed at length in Chapter 10 on air traffic system technologies, 
aviation is transitioning toward a new communications, navigation, and 
surveillance/air traffic management (CNS/ATM) environment. This will 
inevitably change the way pilots communicate and navigate. 

For starters, most ATC messages would be sent by datalink to and from the 
airplane rather than by voice. Navigation would be based more on satellites than 
on land-based navigation aids, and traffic surveillance would be achieved by 
networking tactical information among all aircraft. The benefits of these 
changes, particularly to the airlines, are potentially enormous. A global 
navigation and communications system will allow for higher traffic density and 
improved safety, while at the same time enabling airplanes to fly at optimum 
altitudes and on more direct routes. Voice mode will still be essential for 
emergencies and other nonstandard communication, but for the most part, 
tomorrow’s flight decks will be much quieter without the perpetual stream of 
ATC chatter heard through radiofrequencies on traditional flight decks. 

As envisioned, the transition from today’s airspace environment, in which 
routes are rigidly assigned by controllers on the ground, will move first to a 


system in which flight plans are originated in the airplane and approved by 
controllers on the ground. Then at some point perhaps flight plan changes will be 
initiated in the airplane in real time and simply monitored from the ground. 

But this does not mean that the conventional terrestrial navigation systems 
will disappear overnight. In the United States, the FAA plans to keep very high 
frequency omnidirectional range (VOR) and distance-measuring equipment 
(DME) in operation for at least another decade. During this time, pilots’ 
dependency on the equipment will decrease as more flight operations use 
satellites to navigate. However, the susceptibility of GPS to interference 
probably means VORs will be around for a long time to come, as most observers 
believe. 

The future will bring increased capabilities, some of which will include 
digital communications to accommodate high-speed data to and from the 
cockpit, WAAS/GBAS approaches and landings, GPS-based en route 
navigation, and automatic dependent surveillance broadcast (ADS-B) procedures 
allowing new sophistication in flight tracking and traffic avoidance. Also during 
this time, today’s VHF voice communications will slowly give way to increased 
digital communications, and surveillance systems will become more 
sophisticated, moving away from today’s Mode S transponders, ATC 
surveillance radar, and Traffic and Collision Avoidance System (TCAS) to the 
modern ADS-B system of the future. The result will be a better near-range 
picture of traffic, and therefore, call for far less callouts of other aircraft by air 
traffic controllers. 

There is a tremendous need to provide data to the flight deck from the ground. 
In the future, digital communications are expected to make today’s VHF 
communication radios obsolete, even those that are now undergoing updates for 
8.33 kHz requirements in Europe. The new infrastructure will require radios that 
can transmit in both voice and high-speed digital formats. The VHF Datalink 
(VDL) Mode 2 system is already in operation, and the FAA has already proven 
the efficiency of the CPDLC system in high-density air traffic areas. ADS-B 
avionics that are under development include a cockpit display of traffic 
information (CDTI) feature that enables the pilot to “see and avoid” other 
aircraft electronically. Figure 8-4 shows an experimental NASA CDTI taking the 
place of a traditional flight deck navigation display, depicting a traffic conflict 
requiring pilot-selected de-confliction when flying under autonomous flight rules 
versus relying on ATC for de-confliction. 
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FIGURE 8-4 NASA experimental CDTI. (Source: Authors) 


Using modern ADS-B technology, aircraft emit signals that tell its position to 
other similarly equipped aircraft in the area. This information is depicted 
visually on a display on the flight deck and will greatly enhance a pilot’s 
awareness of the position of other ADS-B equipped aircraft and lead to safer 
operations. The United Parcel Service’s (UPS) efficient use of CDTI at its hub in 
Louisville has proven that substantial fuel savings can also be gained by use of 
ADS-B en route descent technology. 

By reducing dependency on voice transmissions, pilot workload will 
presumably be greatly reduced. For en route applications, communications via 
datalink will be implemented first. Most observers agree it will probably be at 
least a decade before we see heavy use of digital communications in the terminal 
area. The transition from voice to digital communications will evolve fairly 
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SIOWLY, observers Delleve, Tirst because pllots need to become more comfortaDle 
with the idea of sending and receiving information in this format. The second 
reason is because thousands of older airplanes will require new avionics to 
receive and send data via digital link. 

Avionics makers must also develop new radios that can be updated through 
software changes rather than expensive hardware upgrades. If we have learned 
anything from the personal computer industry, it is that the new technology 
constantly being developed can quickly make yesterday’s equipment obsolete. 
The challenge for aviation will lie in developing avionics systems that have 
reasonably long, useful lives at a reasonable cost. 

The potential for change and innovation in the navigation and 
communications infrastructure is limitless, and when it finally evolves, the 
modern flight deck will be a markedly different place from what it is today. 


FLIGHT DECK DISPLAYS 


Most observers did not imagine that the LCD would replace the cathode-ray tube 
as quickly as it did. Advances in commercial LCD production, however, helped 
bring costs down, while avionics makers enhanced off-the-shelf products for 
unmatched levels of fidelity. Today, all new avionics suites for jets are being 
designed around large-format LCDs. Just how big the displays will grow 
depends largely on what happens in the market for commercial LCDs. 

The future vision of avionics makers is to use displays that spread across the 
entire flight deck someday. Some are looking at new technologies such as gas- 
plasma displays or projection displays to meet this goal. For now, however, the 
LCD is the most cost-effective way to bring the information needed for 
tomorrow’s flight environment to the flight deck. 

Using LCDs, avionics makers plan to integrate terrain, traffic, and weather 
information and display it on top of charts and approach plates, which will 
provide a seamless source for information layered in such a way that pilots can 
better interpret the overall flight situation. Tomorrow’s flight deck will be more 
dependent on sophisticated computer software that will greatly enhance the 
capabilities of the avionics, while at the same time adding to the complexity of 
computer systems. To help pilots better manage the technology, cursor-control 
devices, similar to a computer mouse, will be used at first to scroll through 
simple menus and later to plan entire flights. Figure 8-5 is an example of a 
multifunctional display showing superimposed, real-time weather and navigation 
information during Hurricane Irene in 2011. Displays such as this, which show a 
combination of aircraft, meteorology, and navigation information, are typical of 


those being installed in many modern flight decks. 
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FIGURE 8-5 State-of-the-art flight deck display. (Source: Authors) 


HEAD-UP DisrLays (HUDs) 


Head-up displays will become much more commonplace in tomorrow’s flight 
decks, experts believe, particularly if manufacturers can bring costs down. A 
number of HUD makers may shift their engineering focuses and begin looking at 
the use of smaller lenses and direct-projection HUDs, such as those used by the 
military in the C-17. This would eliminate the need for the large optics 
projectors and image collimators used today, making the systems far simpler to 
install and maintain. 

Head-up displays present vital aircraft performance and navigation 
information to the pilot’s forward field of view. The information on the HUD is 
collimated so that symbols appear to the human eye to be at infinity and overlaid 
on the actual outside scene. shows how symbols appear to a pilot 


looking through the HUD. The use of HUDs is gaining broad acceptance in 
aviation as flight crews realize the tremendous benefits to situational awareness 
that they can provide. 


FIGURE 8-6 The view through a HUD while parked on a ramp. (Source: Authors) 


Also, use of the new enhanced flight vision system (EF VS), a display that 
allows pilots to see through low-visibility weather, could become commonplace 
in the cockpit of the future. Forward looking infrared (FLIR) thermal cameras 
have been developed to display a real-world visual image to the cockpit allowing 
the pilot to “see” in very low visibility conditions. Additionally, HUD systems 
are also being developed to display new synthetic vision system (SVS) images. In 
contrast to the EFVS, SVS produces a computer-generated artificial image using 
moving map and terrain databases to provide a more realistic view of the outside 
environment. Recently, display researchers have even combined EFVS with 
SVS to improve the visual picture. Combining the real work reliability of the 
EFVS FLIR with the terrain and situational awareness of SVS could 
dramatically reduce issues associated with low-visibility approaches in the 


future. 


ELECTRONIC FLIGHT BaGs (EFBs) 


In the near future, electronic flight bags (EFBs) will begin to show up with 
greater regularity on the flight deck. A number of avionics makers have already 
introduced such devices, which pilots would use to review charts and approach 
plates, perform weight and balance calculations, and plan flights, among other 
functions. 

Eventually, with the inclusion of chart databases that can be viewed on the 
MFD and EFBs, paper may vanish from the flight deck altogether. Of course, the 
transition from a paper chart that the pilot can hold in his or her hands to 
electronic-only format will be slow for some operators, especially for airlines in 
developing world countries without the financial resources or technology to 
implement these changes. 


NEXT-GENERATION FLIGHT OPERATIONS 


In a NextGen environment, pilots would be released from the rigid discipline of 
being spaced in nose-to-tail time blocks, along less-than-optimum routes, and 
often at inefficient altitudes. Extended to its ultimate application, NextGen 
would embrace the airplane’s complete operation, from start-up at the 
originating airport to shutdown at the destination after having flown a direct, 
nondeviating course, flying the optimal performance figures straight out of the 
airframe manufacturer’s operating handbook. 

To make this new era possible, operators will need to install new avionics, the 
most critical being based upon ADS-B technology. The current Mode S 
transponders will eventually take on a much more sophisticated role as ADS-B is 
implemented. Also required for NextGen will be datalink radios, which would 
be used to pass as much information as practical over discrete controller-pilot 
frequencies. 

Once the transition to a NextGen-based traffic regime begins, observers 
believe airlines will begin updating the current fleet fairly rapidly. The 
technological challenges involved are large but not insurmountable, which 
means the future may be nearer than we realize. From a human factors point of 
view, major changes in NextGen flight decks also provide new opportunities for 
human error and significant training challenges. 


ASRS EXAMPLES 


As more aircraft incorporate automated features into the flight deck, more and 
more reports are appearing in the Aviation Safety Reporting System (ASRS) 
about the learning curve associated with new technology. The following two 
reports demonstrate the need for pilots to understand how advanced systems 
work in order for the systems to work as an aid to pilots versus as a contributor 
to human error. 

In the first report, two pilots of an Embraer 190 jet experienced a track 
deviation when their Flight Management Computer (FMC) responded in an 
unanticipated manner when there was a runway change. They neglected to verify 
inputs to the FMC for the new runway and should have put the autopilot in a 
different mode to keep it on the correct arrival route. However, due to a quirk in 
the navigation system, the plane went back to the beginning of the arrival 
procedure by default as result of the runway change. This process, according to 
the pilots, was counterintuitive and very illogical. Future training programs 
should catalogue the prevalence of such quirks and train pilots to watch for such 
unexpected situations. 

Another example involves a Boeing 737-800 flight crew missing an altitude 
constraint on the published flight plan before reaching the airport. ATC had 
cleared the plane to land on Runway 24R. The pilot changed the runway in the 
plane’s automated system. At that time, the plane was on autopilot descending 
with the elevators controlling the pitch attitude of the aircraft to follow a 
programmed vertical path. However, after the new runway was inserted in the 
computer, the automation changed to have the elevators control the pitch attitude 
of the aircraft to control speed versus to follow the vertical path. Neither of the 
pilots noticed the switch from flying toward a vertical path to flying to a set 
speed since they were focused on the runway change. This was a lesson to both 
pilots that they need to monitor any changes to the modes being selected by the 
automation so that they always know how the aircraft is being flown. Remember 
the old adage: “Aviate, Navigate and Communicate” in that order. If all else 
fails, “Fly the aircraft.” 


CONCLUSION 


It may seem obvious when you think about it, but commercial aviation safety is 
intimately connected to the design of the various aircraft that form the backbone 
of the transportation system. Over the past century, the industry has learned from 
many painful lessons and incorporated new knowledge into making aircraft both 


safer and more efficient. 

The jet age brought with it a significant increase in capabilities and reliability 
but also new challenges, such as structural fatigue and very long service life for 
aircraft. By leveraging knowledge from military jet programs, the manufacturers 
of commercial aircraft have been able to accelerate development of all the 
systems that make up the modern airliner, such as electronics, automation, 
structural resilience, and propulsion. Advancement has come via an evolutionary 
process, often prompted by painful accident investigation experience. 

Some principles developed over half a century ago, such as fail-safe design, 
have become fundamental to current and future designs. Other principles and 
regulatory guidance for the design of aircraft for safety have stemmed from 
dramatic events, such as when the fuselage ripped open on Aloha Airlines Flight 
243 due to the uncontrolled propagation of a crack, and ultimately resulting in 
the passing of the Aging Aircraft Safety Act by the U.S. Congress. 

Different aircraft manufacturers can follow contrasting design philosophies, 
as evidenced in the approach toward automated flight envelope protections 
between Boeing and Airbus, where aircraft such as the A-320 use electronic 
lines of defense referred to as error-resistant or error-tolerant systems that 
prevent certain types of control inputs versus Boeing aircraft that present limit 
information but do not necessarily restrict pilot actions. 

Modern flight deck designs must be developed with NextGen airspace 
requirements in mind, as illustrated by CDTI systems that allow pilots to self- 
resolve traffic conflicts and even plan their own spacing requirements in densely 
packed airspace. The pilots of the Embraer 190 and Boeing 737-800 featured in 
the ASRS examples show the importance of designing new automated systems 
so that their operation is transparent and intuitive. 

Lastly, no matter how well we design aircraft, much of the safety value chain 
is formed by how well humans utilize the new technology. We have made 
extremely reliable and highly automated aircraft safety systems to the point 
where humans are unable to retain some basic skills associated with being a 
pilot. Figure 8-7 shows an increasingly rare sight on the modern flight decks of 
commercial airliners. Hand-flying a jet is on the extinction list of common pilot 
duties. So it is fitting that this chapter mostly speaks about designing aircraft but 
finishes by discussing the human part of the design equation. 
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FIGURE 8-7 The pictured pilot has his hands on the controls. Modern pilots are urged to hand-fly aircraft 
occasionally to maintain flying skills because autopilots do most of the flying today. (Source: Authors) 


KEY TERMS 


Aging Airplane Safety Rule (AASR) 

Aircraft Communications Addressing and Reporting System (ACARS) 
AIRcraft Maintenance ANalysis (AIRMAN) 

Antiskid System 

Auto Slat Gapper 

Automation Surprise 

Central Maintenance Computer System (CMCS) 
Cockpit Display of Traffic Information (CDTI) 
Cockpit Voice Recorder (CVR) 

Computational Fluid Dynamics (CFD) 

Controller Pilot Data Link Communications (CPDLC) 
Electronic Flight Bags (EFBs) 

Engine-Indicating and Crew-Alerting System (EICAS) 


Enhanced Airborne Flight Recorders (EAFRs) 
Enhanced Flight Vision System (EFVS) 
Extended-Range Twin-Engine Operations (ETOPS) 
Fail-Safe or Damage Tolerance Design 
Flight Data Recorder (FDR) 

Flight Management System (FMS) 

Flight Simulator 

Fly-by-Wire 

Forward Looking Infrared (FLIR) 

Garbage in, Garbage out 

Ground-Proximity Warning System (GPWS) 
Head-Up Display (HUD) 

High Altitude Clear Air Turbulence (HICAT) 
High-Lift Systems 

Liquid Crystal Display (LCD) 

Multifunction Displays (MFDs) 
Multiple-Site Damage (MSD) 

Primary Flight Display (PFD) 

Sterile Operation 

Stick-Shaker 

Synthetic Vision System (SVS) 

Thrust Reversers 

Traffic Collision Avoidance System (TCAS) 
VHF Datalink (VDL) 

Widespread Fatigue Damage (WFD) 

Wind Shear 

Wind-Tunnel Testing 

Wing Spoilers (Speed Brakes) 


REVIEW QUESTIONS 


1. Discuss some of the early developments in jet engine technology that were 
included in the Boeing B-47 and Dash 80 aircraft. 


2. What was the purpose of pod-mounted engine installation? 


3. What were some of the challenges to safety resulting from such radical 
airframe designs as highly swept wings, high wing loading, increased 


speeds, and long-duration flights at high altitudes? 
4. Describe some technological improvements in the following stopping 
systems: 
a. Antiskid system 
b. Fuse plugs in the wheels 
c. Wing spoilers 
d. Thrust reversers 
5. What is meant by a fail-safe design? 
6. List and discuss the parameters that define the age of an aircraft. 
7. What are some of the technological advances that enhanced the flight 
handling characteristics of today’s generation of aircraft? 
8. Who are the three major participants in the structural safety process? 
Describe their individual roles. 
9. What are some of the solutions to the problems of turbulence, winds, wind 
shear, ice and precipitation, and volcanic ash? 
10. How do ice and precipitation affect airplane operation? Describe several 
technologies designed to address this problem. 
11. List and briefly describe at least five flight deck technology changes that 
have made a significant contribution to improving safety. 
12. What are the basic purposes of GPWS, TCAS, and EICAS? 
13. What are the basic functions of the flight management system (FMS)? 
14. What is computational fluid dynamics (CFD)? 
15. Discuss some of the technological advances in communications, navigation, 
and displays including HUDs and EFBs. 
16. Describe the functions of EFVS and SVS. 
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LEARNING OBJECTIVES 


After completing this chapter, you should be able to 


e Discuss the regulatory chronology of airport certification. 

e Compare and contrast the four airport certification classes. 

e Discuss the airport certification process. 

e Identify and differentiate between the two types of airport certifications. 

e Explain what the Airport Certification Manual is and discuss its significance. 
e Identify the elements of an Airport Certification Manual. 

e List and explain the required elements of an Airport Emergency Plan. 


e Identify the sources of safety hazards and the applicable regulations that 

govern the following: 

e Airport terminal buildings 

e Hangars and maintenance shops 

e Ramp operations 

e Aviation fuel handling 

e Aircraft rescue and firefighting (ARFF) 
e Deicing and anti-icing 

e Describe the airport surface operational environment. 

e List the individual groups involved with airport surface operations. 

e Define and discuss the following terms relating to runway safety: runway 
incursion, operational incident, pilot deviation, and vehicle/pedestrian 
deviation. 

e Discuss runway incursions, trends, and statistics with respect to rates and 
severity. 


e List and discuss control strategies and initiatives that are being proposed to 
minimize the occurrence of runway incursions. 


INTRODUCTION 


Although not the case in other types of aviation, the commercial aviation 
operations discussed in this book all commence and terminate at airports. The 
design of airports and the operations that support commercial flights must all be 
structured around safety. A commercial airport, by definition, is a tract of land 


(or water) that provides facilities for landing, takeoff, shelter, supply, and repair 
of aircraft and has a passenger terminal. This results in a diverse collection of 
complex operations each with its own set of safety issues. This chapter provides 
an overview of the certification process, the certification manual, and safety 
issues concerning airports. Extended discussions are conducted on some of the 
more hazardous operations, such as fuel handling and runway incursions. 
Highlights of FAA Federal Aviation Regulations Part 139 and other relevant 
regulations are also reviewed. 


AIRPORT CERTIFICATION 


The Federal Aviation Act of 1958 was broadened in 1970 to authorize the FAA 
Administrator to issue operating certificates to certain categories of airports 
serving air carrier aircraft. The 1970 Act also added a clause that barred any 
person from operating an airport or any air carrier from operating in an airport 
that did not possess a certificate if it was required or if the airport was in 
violation of the terms of an issued certificate. 

The intent of the certification was to establish minimum safety standards for 
the operation of airports to ensure the safety of the flying public. To be certified 
by the FAA, airports are required to meet certain standards for airport design, 
construction, maintenance, and operations as well as firefighting and rescue 
equipment, runway and taxiway guidance signs, control of vehicles, 
management of wildlife hazards, and record keeping. The FAA works with 
certificated airports to help them meet these standards through periodic 
consultations and site inspections. 


AIRPORT CERTIFICATION CLASSIFICATION 


The FAA classifies U.S. airport as follows under FAR Part 139 (www.faa.gov): 


e Class I Airport—an airport certificated to serve all of the following: 
scheduled operations of large air carrier aircraft, unscheduled passenger 
operations of large air carrier aircraft, and/or scheduled operations of small air 
carrier aircraft. 


e Class II Airport—an airport certificated to serve both scheduled operations of 
small air carrier aircraft and unscheduled passenger operations of large air 
carrier aircraft. A Class II airport cannot serve scheduled large air carrier 
aircraft. 


e Class III Airport—an airport certificated to serve scheduled operations of 
small air carrier aircraft. A Class III airport cannot serve scheduled or 
unscheduled large air carrier aircraft. 


e Class IV Airport—an airport certificated to serve unscheduled passenger 
operations of large air carrier aircraft. A Class IV airport cannot serve 
scheduled large or small air carrier aircraft. 

e Joint-Use Airport—means an airport owned by the Department of Defense, at 
which both military and civilian aircraft make shared use of the airfield. 


In the United States, there are approximately 532 Part 139 airports as of 
September 2016 classified as follows (www.faa.gov): 


Class I: 395 airports 
Class II: 29 airports 

Class III: 29 airports 
Class IV: 79 airports 


An airport that meets FAR Part 139 criteria is issued an Airport Operating 
Certificate (AOC). To obtain a certificate, an airport must maintain specific 
operational and safety standards. The FAA generally provides guidance on 
meeting the requirements of Part 139 certification through documents called 
Advisory Circulars (ACs). The FAA also issues annual CertAlerts through the 
Airport Safety and Operations Division of the Office of Airport Safety and 
Standards that serve as a quick means of providing both the public and FAA 
staff with important certification-related guidance. 

Fully certificated airports must maintain an Airport Certification Manual 
(ACM) that details operating procedures, facilities, equipment, and other 
appropriate information as listed in the following section. 


AIRPORT CERTIFICATION MANUAL (ACM): FAA AC No. 150/5210-22 


Every certificated airport that serves air carriers is required to have an ACM in 
accordance with Part 139. The ACM is a working document that outlines the 
means and procedures used to comply with the requirements of Part 139. While 
each airport has its own unique features and operational requirements, its Airport 
Certification Manual must contain basic elements appropriate to its class, which 
include the following: 
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Lines of succession for airport operations responsibility. 


Each current exemption from Part 139 issued to the airport from the 
requirements. 


Any limitations imposed by the FAA Administrator. 


A grid map or other means of identifying locations and terrain features on 
and around the airport that are significant to emergency operations. 


The location of each obstruction required to be lighted or marked within the 
airport’s area of authority. 


A description of each movement area available for air carriers and its safety 
areas, and each road that serves each area. 


Procedures during construction work for avoiding the interruption or failure 
of utilities serving facilities or NAVAIDS that support air carrier 
operations. 


A description of the system for maintaining records. 

A description of personnel training. 

Procedures for maintaining the paved areas of the airport. 
Procedures for maintaining the unpaved areas of the airport. 
Procedures for maintaining the safety areas of the airport. 


A plan showing the runway and taxiway identification system, including the 
location and inscription of signs, runway markings, and holding position 
markings. 

A description of and procedures for maintaining the marking, signs, and 
lighting systems. 

A snow and ice control plan. 

A description of the facilities, equipment, personnel, and procedures for 
meeting the aircraft rescue and firefighting requirements. 

A description of any approved exemption to aircraft rescue and firefighting 
requirements. 


Procedures for protecting persons and property during the storing, 
dispensing, and handling of fuel and other hazardous substances and 
materials. 


A description of and procedures for maintaining the traffic and wind 
direction indicators. 


An Airport Emergency Plan (AEP). 
Procedures for conducting the airport self-inspection program. 


22. Procedures for controlling pedestrians and ground vehicles in movement 
areas and safety areas. 

23. Procedures for obstruction removal, marking, or lighting. 

24. Procedures for protection of NAVAIDS. 

25. A description of public protection at the airport. 

26. Procedures for wildlife hazard management. 

27. Procedures for airport condition reporting. 

28. Procedures for identifying, marking, and lighting construction and other 
unserviceable areas. 


29. Any other item that the FAA Administrator finds is necessary to ensure 
safety in air transportation. 


(Source: FAA.gov) 


The Airport Emergency Plan is an integral part of the ACM, although it may be published and 
distributed separately to each user or airport tenant. The plan must be extremely detailed and provide 
sufficient guidance on response to all emergencies and abnormal conditions that the airport is likely to 
encounter. Emergencies include aircraft accidents; bomb threats; sabotage; hijackings; major fires; 
natural disasters such as floods, tornadoes, and earthquakes; and power failures. Emergency response 
plans should spell out procedures for internally coordinating with airport and firefighting personnel and 
the control tower. In addition, procedures should be established for coordination with external agencies 
such as law enforcement, rescue squads, fire departments, ambulances and emergency transportation, 
and hospital and medical facilities. The Airport Emergency Plan must be reviewed at least annually, and 
for Class I airports there must be a full-scale exercise of the plan every 3 years. (Source: FAA AC No. 
150/5200-31C) 


OPERATIONAL SAFETY 


As mentioned earlier, airport operations are complex and diverse, with hazards 
and their severity varying by the type of operation. For the purposes of our 
discussion, airport safety issues will be discussed under the following headings: 


e Airport terminal buildings 
e Hangars and maintenance shops 
e Ramp operations 


e Specialized airport services 
e Aviation fuel handling 
e Aircraft rescue and firefighting (ARFF) 
e Deicing and anti-icing 


AIRPORT TERMINAL BUILDINGS 


These facilities are laid out to minimize passenger delays and maximize 
throughput of travelers from the airport terminal entry point to the aircraft. 
Inadequate layout and facility size leads to overcrowding, which can cause 
dangerous conditions that lead to injuries. Due consideration to safety should be 
given during the design, construction, and modification of the facilities so as to 
minimize hazards that cause falls and to protect people from harmful contact 
with machinery. Most of the design standards and requirements for building 
materials, fire protection, and building egress are covered by building codes 
(e.g., the International Building Code); the National Fire Protection Association 
(NFPA); the American National Standards Institute (ANSI); and other local, 
state, and federal agencies. For operational issues, airports should adhere to 
OSHA standards (which incorporate many of the standards from the above- 
mentioned organizations). A summary of important safety considerations for 
airport terminal facilities follows: 


e Emergency evacuation and egress routes, signs, and other marking should 
conform to the Life Safety Code, NFPA 101, and OSHA regulations 29 CFR 
Part 1910, Subpart E, “Exit Routes, Emergency Action Plans, and Fire 
Prevention Plans.” Some additional notes are that: 

e Exits should be well lighted and marked. 

e Panic hardware should be installed and properly working on the inside of 
exterior doors used for emergency exits. 

e Exits doors should be kept unobstructed and unlocked in the direction of 
egress. 

e Emergency evacuation plans should be posted in all buildings. 


e All areas must be accessible to persons with disabilities (more information on 
the Americans with Disabilities Act of 1990 and this topic can be found in 
Advisory Circular 150/5360-14). 


e All slip and trip hazards must be eliminated, and fall prevention strategies 
should be implemented on stairways, escalators, and moving walkways. 


e Stairs, ladders, and ramps should be kept clean and free of obstacles or 
slippery substances and should be maintained in good condition. Both interior 
and exterior stairways should be sufficiently lighted so that all treads and 
landings are clearly visible. Prevention of falls, slips, and trips on any walking 
and working surface is regulated under 29 CFR Part 1910 Subpart D. 


e There must be safe access to heating, ventilation, and air-conditioning 


systems for maintenance to permit safe and convenient replacement of heavy 
equipment (e.g., pumps and motors). In this connection, safe means for 
maintaining luminaries and windows must be provided. 


e Skylight and roof openings must be provided with protective screens to 
prevent individuals from falling through. 


e Doors should open automatically to eliminate inconvenience to people with 
baggage and to the handicapped. Also, doors should open away from the 
person going through. 


e Escalators, elevators, and moving sidewalks should comply with ANSI 
Standard A17.2 (Series). Speeds for moving walkways and escalators should 
be set at the lower limit of the acceptable range. 


e Moving walkways should have emergency stop buttons at both ends, and, 
wherever feasible, every 50 meters apart. Attention-grabbing techniques 
should be installed to warn passengers that they are approaching the end of a 
moving walkway. 


e Ticket counters should be ergonomically designed to permit safe body 
postures during baggage handling and data entry. Weight scales and post 
weigh-in baggage conveyors should be installed as close to floor level as 
practical to minimize lifting, and entrances to the scales should be free so as 
to permit baggage sliding as opposed to lifting. OSHA regulates ergonomic 
hazards (or any other recognized hazard that does not have a specific 
regulation) under the General Duty Clause listed in Section 5(a) of the OSHA 
Act. 

e All electrical systems and power service should be installed, maintained, and 
inspected according to the National Electrical Code, NFPA 70. OSHA 
regulates electrical practices under 29 CFR Part 1910 Subpart S. 

e Fire extinguishers and sprinkler systems should be installed and maintained in 
accordance with NFPA 10 and NFPA 13. OSHA addresses fire prevention 
under 29 CFR Part 1910 Subpart L. 


HANGARS AND MAINTENANCE SHOPS 


e Maintenance and other operational issues 
e Roofs should be inspected regularly, especially after violent storms. 
e The maximum allowable loading per square foot of floors should be 
prominently displayed in all storage areas to avoid damage or collapse. 
e Floors and stairways should not be waxed if it creates a slipping hazard. 


e Planning and design guidance for airport terminals is included in Advisory 
Circular (AC) 150/5360-13 and AC 150/5360-9 for non-hub locations. 
Construction of hangars is covered by federal, state, and local building codes 
as well as many National Fire Protection Association standards. Operational 
issues are mostly covered by OSHA and EPA requirements. Some of the 
highlights include the following: 

e Walkways and working surfaces 

e Adequate aisle space and access to fire extinguishers, hoses, sprinkler 
control valves, and fire alarm stations should be maintained. 

e If work is performed at elevations in excess of 4 feet, the worker must be 
protected from falling by providing guardrails 42 inches high with an 
intermediate rail approximately halfway between the top rail and the 
standing surface. If guardrails are not feasible, an equivalent effective 
means of fall protection (safety harnesses, nets, etc.) must be provided. 
Regardless of height, if a work platform is adjacent to a hazard (e.g., 
dangerous equipment), then the worker must be protected from falling. 
Toe boards should be provided for the work platform on the open sides to 
prevent objects from falling on persons passing beneath or if there is 
moving machinery or if there is equipment with which falling material 
could create a hazard. 

e Electrical 

e Large metal complexes such as aircraft docks should be permanently 
bonded, grounded, and secured to a permanent structure such as a hangar 
floor. Primary sources of electric power to hangars should be approved 
for the location according to the National Electrical Code, NFPA 70, and 
aircraft hangars, NFPA 409. 

e All other electrical operational issues such as grounding, wiring, 
receptacles, and circuit breakers are covered by 29 CFR Part 1910 
Subpart S. 


COMPRESSED GAS, FLAMMABLES, AND HAZARDOUS AND TOXIC 

SUBSTANCES. Storing and handling of compressed gases and flammable and 
combustible liquids are addressed under 29 CFR 1910 Subpart H, Hazardous 
Chemicals. Many of these standards reference or incorporate those developed by 
the NFPA and the Compressed Gas Association. Toxic and hazardous 
substances are addressed under 29 CFR Part 1910 Subpart Z. 


e 29 CFR 1910.101(b) addresses the in-facility handling, storage, and 


utilization of all compressed gas cylinders. These cylinders should be secured 
and stored upright when not in use and should be stored in carts designed for 
that purpose when in use. Gas cylinders should have their caps on except 
when in use. Cylinders of compatible gases should be stored together, and 
oxygen cylinders should be stored separately from flammable gas cylinders 
and other flammable or combustible substances. 


General-purpose compressed air systems should not exceed 30 pounds per 
square inch unless specifically required (e.g., for tire inflation and special- 
purpose pneumatic tools). The practice of using compressed air to clean 
personal clothing should be avoided. 


All flammable and combustible materials (paints, hydraulic fluids, greases, 
solvents, cleaning agents, etc.) should be stored and used in accordance with 
NFPA 30. Information on the use and handling of specific materials and 
processes can be found in 29 CFR Part 1910 Subpart H and 29 CFR Part 1910 
Subpart Z, Toxic and Hazardous Substances. 


Storage of flammables should be limited to quantities that are permitted for 
immediate short-duration uses in the shop areas. These chemicals should be 
stored in labeled cabinets designed and approved for flammable storage. Bulk 
storage of flammables should be in separate buildings designed for that 
purpose, which include design features such as explosion-proof electrical 
systems, spill containment, and automatic fire protection. Storage quantity 
requirements for shop and bulk storage can be found in 29 CFR 1910.106. 


Painting and stripping are hazardous activities that use toxic chemicals, and 
thus, must be performed in well-ventilated areas that are separate from other 
maintenance activities and are designed for that purpose (e.g., paint booths). 
In addition, painting and stripping generate toxic wastes that must be 
contained and either recycled or disposed of appropriately. Therefore, these 
operations are governed by both OSHA and EPA regulations. 
Miscellaneous on-site use of all chemicals is covered under OSHA’s Hazard 
Communication Standard, 29 CFR Part 1910 Subpart 1200. This standard 
comprehensively addresses the issues of chemical hazard evaluation, 
employee hazard communications, and employee personal protective 
equipment and procedures. 


In summary, this subpart requires the following: 


e Developing and maintaining a written hazard communication program for the 


workplace, including lists of hazardous chemicals present on site. 


Labeling chemical containers in the workplace and those being shipped to 
other workplaces. 


Preparing and distributing material safety data sheets (MSDS) to employees. 
Developing and implementing employee training programs that detail the 
hazards of chemicals on site and what employees must do to protect 
themselves. 


Miscellaneous upkeep of shop and hangar areas: 


The control of hazardous energy standard (29 CFR 1910.147) covers the 
servicing and maintenance of machines and equipment in which the 
unexpected energization or start-up of machines or equipment, or release of 
stored energy (electrical, hydraulic, pneumatic, or gravity), could cause injury 
to employees. This standard requires maintenance personnel, through written 
equipment-specific procedures, to de-energize stored energy and positively 
block off all potential energy sources to systems that are being worked on by 
using personalized locks and tags; a process known as lockout and tagout, 
sometimes referred to by the acronym LOTO. 


Material handling equipment such as overhead and gantry cranes that are used 
to move large aircraft sections are regulated under 29 CFR 1910.179. Slings, 
chains, and hoists used to move or lift smaller aircraft parts and sections (e.g., 
aircraft jacking) are regulated under 29 CFR 1910.184. 


The use of powered material handling equipment, such as fork trucks and 
hand trucks, and the use and maintenance of batteries used to power these and 
other equipment are regulated under 29 CFR 1910.178. 


Hoist units, such as those used to reach large aircraft tails, should comply with 
safety requirements listed under 29 CFR Part 1910 Subpart F, Powered 
Platforms, Manlifts, and Vehicle-Mounted Work Platforms. 


Heating and ventilation systems in hangars should be in accordance with 
NFPA 409 or the equivalent. 


Welding, cutting, brazing, and other hot works that have the potential to start 
fires are regulated under 29 CFR Part 1910 Subpart Q. 


Noise evaluation and hearing protection for processes such as riveting, sand 
blasting, grinding, polishing, and other noisy operations that exceed 85 
decibels (time-weighted A scale for 8 hours) are regulated under 29 CFR 
1910.95. 


The safe use of pedestal grinders and other grinding wheels is regulated under 


29 CFR 1910.215, Abrasive Wheel Machinery. 


RAMP OPERATIONS 


The ramp area is generally designed for aircraft, not the vehicles that service 
and/or operate in the proximity of the aircraft. Most of the signs and markings 
are for aircraft. Figure 9-1 shows a Delta airplane during a push-back. Ground 
markings are also visible in the figure and are used to assist with orientation on 
the ramp. The figure also shows a baggage cart driver stopped to allow the 
aircraft movement and a so-called wing-walker ensuring that the wingtip and 
other aircraft areas do not contact obstructions. The ramp area sees a diverse 
collection of high-paced activities that involve aircraft, vehicles, and individuals 
working in close proximity to one another. Some of these activities include the 
following: 


FIGURE 9-1 A busy ramp is typical of airports hosting commercial aircraft. (Source: Authors) 


e Aircraft ground handling that may include taxiing, towing, chocking, parking, 
or tie-down 


Aircraft refueling 

Aircraft servicing—catering, cleaning, food service, etc. 
Baggage and cargo handling 

Conditioned air supply 


Power supply 
Routine checks and maintenance 


Individuals involved with the above activities are exposed to several of the 


occupational hazards (and hence regulated by similar regulations) mentioned 
earlier, including: 


Cuts (from antennas, pitot tubes, static discharge wicks). 

Slips, trips, and falls (on the ground and from elevations). 

Strains and sprains (from baggage handling). 

Exposure to hazardous materials (fuel). 

Contact with moving parts (propellers) and bumps (undersurface of fuselage). 


Electrical hazards (tools, motor, generators)—electrical wiring should 
conform to National Electric Code, NFPA 70, for class I, Group D, Division I 
hazardous locations. 

Biohazards (bloodborne exposures during cleaning, covered under 29 CFR 
1910.1030). 

High-pressure air and other fluid exposures from pressurized systems. 

Noise from engines and other equipment. Hearing protection is a significant 
health and safety issue during ramp operations. 


In addition, there is a potential for significant injury from exposure to jet 


blast, moving aircraft, and moving vehicles. Since most of the operations take 
place outdoors, weather conditions (heat, cold, snow, rain, ice, and wind) can 
increase the risk of injury. Hazards due to aircraft refueling are discussed in the 
next section. 


SPECIALIZED AIRPORT SERVICES 


Specialized airport services are comprised of the following: 


Aviation fuel handling 


e Aircraft rescue and firefighting (ARFF) 


e Deicing and anti-icing 


AVIATION FUEL HANDLING. Fuel handling is an important safety issue not only 
to the fuelers but also to other airport personnel, the traveling public, and the 
operation of the aircraft. Failure to adhere to safe operating procedures when 
fueling aircraft and/or transporting fuel from one location to another on the 
airport can result in major disasters. This potential for disaster is well 
recognized, although millions of gallons of aircraft fuel are handled each year 
without major incidents for the most part. The basic types of aviation fuel are 
aviation gasoline (avgas for general aviation piston operations), jet A or jet B 
(commercial jet uses) fuels, and JP series (military jet uses) fuels. Guidance on 
fuel handling in an airport environment is covered under 14 CFR Part 
139.321(b) and the FAA advisory circulars in the 150 series (e.g., AC 150/5230- 
4A), all of which reflect NFPA standards (Aircraft Fuel Servicing, NFPA 407, 
2007, and Aircraft Fueling Ramp Drainage, NFPA 415, 2008). It is also 
necessary that fueling operations, as shown in Figure 9-2, be conducted in 
accordance with procurement document specifications and all other applicable 
local, state, and federal regulations. Special attention must be paid to federal, 
state, and local hazardous materials regulations and to agency-specific fuel spill 
avoidance requirements. The major aviation safety concerns with fuel handling 
and other ramp hazards are covered in the following sections. 
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FIGURE 9-2 Ramp operators must exercise precautions while refueling jets because of the dangers 
associated with fuel. (Source: Wikimedia Commons) 


HEALTH HAZARDS TO FUELERS. Repeated contact with aviation fuels can cause 
skin irritation and dermatitis. Skin area exposures to fuels should be washed 
immediately with soap and water. Eyewash stations should be conveniently 
located for immediate flushing in case the eyes or face comes into contact with 
fuel. Fuels such as avgas contain additives such as benzene. Hence, fuels can be 
toxic if inhaled or swallowed. Fuels can also affect the central nervous system by 
causing narcosis, which leaves an individual in a state of stupor or 
unconsciousness. Threshold limits for fuel vapors in the breathing zones are 
established by the American Conference of Governmental Industrial Hygienists 
(ACGIH) and 29 CFR 1910 Subpart Z (which reflects ACGIH standards). 


FUEL CONTAMINATION. Fuel contamination is a major safety issue as it can 
affect the operation of the aircraft. Contamination can occur by refueling an 
aircraft with contaminated fuel or the wrong fuel grade or type. Fuel is 
considered contaminated if it contains any material other than what is called for 


in the specifications. The two most common contaminants found in fuels are rust 
and water (free or emulsified). Other contaminants found include microbial 
growths, paint, metal, rubber, and lint. Commingling, or the mixing of different 
fuel grades and types, is also a serious issue. For example, mixing avgas with jet 
fuels can reduce the volatility and antiknock features of fuels needed for 
reciprocating engines, which can result in engine failure. This could also create 
deposits in turbine engines. To prevent commingling, FAA Advisory Circular 
No.150/5230-4 (series) requires the use of separate pumps, lines, standard 
couplings, and color codes for each type of fuel. Also, all fuel-dispensing 
systems should be clearly marked and labeled to indicate the grade and type of 
fuel they contain. 


EXPLOSIONS AND FIRES DURING FUELING OR FUEL TRANSFER. There are three 
essential requirements for a fuel to burn. First, the fuel must be in its vapor form; 
second, it must develop the right fuel-to-air ratio with the surrounding 
atmosphere; and third, there must be a source of ignition to start the fire. In fuel 
handling, the first two conditions invariably exist, and there is very little one can 
do to completely eliminate these hazardous states. Hence, the primary objective 
during fuel handling is to control or eliminate ignition sources. Several ignition 
sources and their control are discussed in the following sections. 


STATIC ELECTRICITY. Static charge discharge is one of the most important 
sources of ignition and presents a constant threat to safe fueling. When two 
dissimilar materials come in contact with each other, a static charge of electricity 
develops by the exchange of positive and negative charges across the contact 
surfaces. Static charges build up when fuel gets pumped through the fuel lines. 
The quantity of static electricity produced is directly proportional to the fuel 
flow rate. Also, due to their lower volatility, jet fuels are generally more 
susceptible to ignition from static discharges than are aviation fuels. Static 
electricity also gets generated when fuel is allowed to free-fall through the air, as 
when a tank is filled through a spout. An electrically charged atmosphere can 
build up charges on an aircraft, as can rain, snow, or dust blowing across the 
aircraft. 

While completely eliminating static charge is impractical, several steps can be 
taken to minimize its buildup. Some of these steps are as follows: 


e Follow correct grounding and bonding procedures, as listed in AC 00-34 
(series), “Aircraft Ground Handling and Servicing.” 


e Avoid pumping contaminated fuels since dirt and water particles in the fuel 


will add to the static charge accumulation. 


e Reduce fuel flow rates to decrease turbulence, where feasible. Reduced flow 
rates allow longer periods for the static charge to dissipate. 


e Prevent fuel from free-falling through the air to the bottom of the tank. 


SPARKS. Arcing may occur when electrical connections are made or from faulty 
equipment and improperly maintained ramp vehicles. To avoid sparks, the 
following precautions should be taken: 


e Aircraft batteries should not be installed or removed, nor should battery 
chargers be operated during fueling operations. 


e Aircraft ground power units should be located as far away as possible from 
the fueling points. 


e Battery-powered tools as opposed to electrically powered tools should be used 
near aircraft during fueling. 


e Aircraft radios should be shut off. Also, fueling should not be performed 
within 100 feet of energized airborne radar. 


e Flashings used near the fueling area should be UL-approved for use in such 
locations. 


e Workers near the fueling area should be advised against wearing footwear 
with metal nails or cleats or metal plates on the heels. 


EXPLOSIONS AND FIRES DURING FUEL TANK REPAIR. Maintenance work on 
aircraft fuel cells and tanks, and on bulk fuel storage tanks presents similar 
inhalation and fire hazards as described above. It is extremely important that 
cells and tanks be drained and thoroughly vented before any maintenance work 
is attempted, especially hot work such as welding, brazing, and cutting. If tanks 
are large enough for an employee to enter and perform work, then confined- 
space testing, entry, and rescue procedures should be adhered to as required by 
29 CFR 1910.146. Positive pressure should be employed for venting and should 
be undertaken with an approved blower (with non-sparking blades and an 
isolated non-sparking blower motor) using a grounded hose. 


MISCELLANEOUS. Other issues to be considered for minimizing ignition sources 
include the following: 


e No-smoking rules should be strictly enforced. 


e Employees should not be allowed to carry matches, lighters, and other 
smoking paraphernalia when engaged in fueling operations. 


e Welding, cutting, or other hot work should not be conducted within at least 35 
feet (preferably 50 feet) of fueling. Similar distance restrictions should be 
maintained for open-flame lights and exposed-flame heaters. 


e Fuel pits should be located at least 50 feet away from a terminal building or 
concourse. 


HAZARDS FROM SPILLS. Fuel spills present varying degrees of safety issues 
depending on the size of the spill and the kind of response required. While 
simple flushing may be appropriate for small spills, larger spills may require the 
use of absorbents, adsorbents, and chemical fixants. Leaks from underground 
storage tanks (USTs) present a different set of safety issues. Spills and USTs are 
regulated by EPA (as mentioned in earlier chapters) and local and state 
jurisdictions. Also, depending on the response planned by the facility, OSHA 
regulations 29 CFR 1910.120 could apply. Some of the issues to consider in 
connection with fuel spills include the following: 


e Leak/spill prevention 

¢ Emergency response procedures 
e Reporting and notifications 

e Spill control/containment 

e Cleanup procedures 

e Employee training 


AIRCRAFT RESCUE AND FIREFIGHTING (ARFF). Responding to aircraft crashes is 
a high-risk job leaving individuals exposed to a wide variety of safety hazards 
such as dealing with fire, smoke, chemicals, blood, other body fluids, and lifting 
in awkward postures. ARFF training, therefore, should include varying levels of 
OSHA training depending on the level of responder involvement. To develop an 
understanding of the safety issues involved with aircraft rescue and firefighting, 
a review of current ARFF procedures is necessary. 

As mentioned earlier, all certificated airports must have a plan to respond to 
all conceivable emergencies. The Airport Emergency Plan is an integral part of 
the Airport Certification Manual. A major emergency that an airport has to plan 
for is aircraft crashes, which are handled under the aircraft rescue and 
firefighting plan. This plan is based on the largest aircraft that is likely to be 
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equipment and agents are contained in FAA regulations as follows: 


e Part 139.315 (Aircraft rescue and firefighting: Index determination). 


e Part 139.317 (Aircraft rescue and firefighting: Equipment and agents). 
e Part 139.319 (Aircraft rescue and firefighting: Operational requirements). 


Aircraft rescue services and firefighting equipment are based on an index as 
determined by the length of the air carrier aircraft and the frequency of 
departures. Figure 9-3 shows an example of the type of fire and rescue vehicle 
that may show up in the event of an emergency. For current information on FAA 
ARFF Advisory Circulars, please see the AC 150/5200 (series) of documents. 
For further information on airport index classification and other ARFF 
requirements refer to Title 14, Part 139 Subpart D (Operations). 
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FIGURE 9-3 ARFF fleets consist of technologically advanced vehicles for fire extinguishing efforts. 
(Source: Wikimedia Commons) 


DEICING AND ANTI-ICING. Ice and snow on control, airfoil, and sensor surfaces 


can have serious repercussions on the safe operation of the aircraft. Hence, when 
freezing or near-freezing conditions are likely to be present, the aircraft should 
not be allowed to takeoff before being sprayed with deicing fluid when 
contamination is present or anti-icing fluid when contamination may occur prior 
to becoming airborne. Once in the air, commercial aircraft have systems that 
prevent the accumulation of most types or icing, but those systems are 
inadequate on the ground due to several unavoidable design criteria. Figure 9-4 
shows a deicing or anti-icing operation underway with spraying protective fluid 
on the top of a main wing. 


' 


FIGURE 9-4 Personnel deicing the wings of an aircraft prior to takeoff. This is essential since wing icing 
can adversely affect the aerodynamics of a plane. (Source: Wikimedia Commons) 


To the naked eye it can be difficult to distinguish if a deicing or anti-icing 
operation is underway. Sometimes a deicing operation is performed first to 
remove contaminants and then is followed by an anti-icing operation if 
precipitation is still occurring that could cause future contamination. Sometimes 
deicing occurs without anti-icing and vice versa. Often both operations are 
described under the term “deicing” out of simplicity. Numerous accidents have 
occurred due to attempted takeoffs with contaminated surfaces. The reader 
should also note that such accidents can happen outside of winter. For example, 


an MD-80 completing a long flight and then performing a quick-turn on the 
ramp in a humid environment, such as Los Angeles, can have frost form on parts 
of the wing since the fuel that was not used in the wings had several hours to 
chill while cruising at altitude. This situation may occur at outside air 
temperatures that are significantly above freezing and on a beautiful sunny day. 
That is why it is not uncommon to see deicing trucks in operation at locations 
such as Los Angeles, which some might find difficult to understand because the 
city is often associated with a modest climate. 

Since this chapter is about airport safety, let us focus on the risks associated 
with the actual deicing/anti-icing operation. Deicing and anti-icing operations 
present five distinct hazards: 


e Damage to the aircraft by the deicing equipment. 


e Application of deicing fluid to areas where it should not be applied, such as 
static ports, pitot heads, angle-of-attack sensors, the engine, and other inlets. 


e Hazards (inhalation and ingestion) to the deicing crew and to the 
environment, since deicing fluids are considered hazardous materials and are 
moderately toxic. 


e Hazards to the crew and passengers if the cabin air intakes are not shut off 
during deicing. 
e Falls, slips, and other safety hazards during the application process. 


Deicing crews should have training as required by OSHA’s Hazard 
Communication standard (29 CFR 1910.1200). Also, material safety data sheets 
(MSDS), which list health hazards and protection information on the deicing and 
anti-icing fluids being used, should be made readily available. The vapors or 
aerosols of deicing fluids can cause nose and throat irritation, headaches, 
vomiting, and dizziness. For high-volume applications it is recommended that 
personnel be fitted with respirators in accordance with 29 CFR 1910.134. 
Ingestion of deicing fluids can affect the kidneys and the central nervous system. 
However, these fluids are so highly diluted with water that large quantities 
would need to be consumed to be lethal. 

Application crews usually work on elevated platforms (baskets at the end of 
booms) and would therefore have to be adequately protected from falling 
through safety harnesses and guardrails. Finally, spent fluid is a regulated waste 
and therefore should be used, collected, and recovered/disposed of in accordance 
with EPA and other federal and local regulations. The FAA has recently adopted 
the European deicing standard called the Standardized International Aircraft 
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Ground peice Program. FAA Advisory Circular 12U-bU (Series) 1s the primary 
FAA guidance document for the development of an air carrier’s ground deicing 
program. 


RUNWAY INCURSIONS 


The prospect of two planes colliding is horrifying. It conjures an image of 
twisted, flaming wreckage falling from the sky. Yet such catastrophic collisions 
can easily occur on the ground when the safe, coordinated use of runways breaks 
down. The worst aviation disaster on record was, in fact, the result of two 
Boeing 747s colliding on a runway at Tenerife Airport in the Spanish Canary 
Islands. It was foggy when the accident occurred in 1977, as the captain of one 
of the Boeing 747s failed to obey a “hold in position” instruction from air traffic 
control (ATC) and started his takeoff roll before the other Boeing 747 cleared 
the runway. This catastrophic incident resulted in the loss of 583 lives. In the 
United States, the deadliest runway incursion accident occurred in August 2006 
in Lexington, Kentucky, when Comair Flight 5191, a regional jet, crashed after 
taking off from the wrong runway, killing 49 of the 50 people on board 
(NTSB.gov). The reasons for these significant problems are varied and complex 
but can be boiled down to human error, often associated with communication 
and operating in a challenging and sometimes confusing environment. 

Improving runway safety was on the NTSB list of “Most Wanted 
Transportation Safety Improvements” for nearly two decades. The FAA’s report 
on incursion severity for the period of FY2004 to FY2007 documents a total of 
1,353 runway incursions spread over nearly 250 million hours of operation. This 
approximates 5.4 runway incursions per million operations. Of these 1,353 
incursions, 92% were minor in nature. While this is a good record by any 
measure, there is serious concern that an increasing number of airplanes, 
vehicles, and people are mistakenly coming dangerously close to each other. 

With predicted increases in air traffic volume in a system that is already 
constrained, the number of incursions would most certainly increase. What’s 
more, even if the incursion rates stay the same, there will be an increase in the 
absolute number of incursions if nothing is done about it, which of course would 
increase the probability of catastrophic incursions. It is for this reason that the 
FAA places a very high priority on controlling runway incursions. Despite the 
fact that pilot deviation errors result in more runway incursions than any other 
factor, minimizing runway incursions requires a joint effort from all groups 
involved in the management of the airport operations system, that is, the pilots, 
controllers, vehicle operators, and other ground staff. 


In recent years, the FAA has joined forces with ICAO member countries and 
industry groups to take an integrated approach to the serious problem of runway 
incursions. A Global Runway Safety Symposium at ICAO in May 2011 
recommended a multidisciplinary approach to improving runway safety 
outcomes. Terminology and definitions used have been harmonized to provide a 
better understanding of the problem of runway incursions. 

Both ICAO and FAA have jointly defined a runway incursion as follows: 
“any occurrence at an aerodrome involving the incorrect presence of an aircraft, 
vehicle, or person on the protected area of a surface designated for the landing 
and takeoff of aircraft.” 

In order to promote global harmonization and effective data sharing, both 
ICAO and FAA have also established a standard classification scheme to 
measure the severity of runway incursions, as seen in Figure 9-5. 
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FIGURE 9-5 Runway incursion severity classification. (Source: FAA) 


According to the latest FAA National Runway Safety Plan (2015-2017), the 
number of most serious incursions—Categories A and B—continued to fall from 
a total of 67 in FY2000 to just 11 in FY2013. Between FY2008 and FY2010, 
Category A and B events fell at a rate of 50% per year. 


AIRPORT SURFACE ENVIRONMENT 


The typical airport surface environment is a complex system of markings, 
lighting, and signage coupled with layouts that vary by airport. Under adverse 
weather conditions, the complexity of the environment increases as visibility 
diminishes and visual cues are concealed. Cryptic signs and surface markings 
together with pilots new to a particular airport pose additional difficulties, as 
does nighttime flying where airport lights blend with background city lights. 

It is within this environment that large numbers of individuals with varying 
levels of experience, training, and language proficiency must concentrate on 
performing their tasks against a backdrop of intense radio communications for 
coordinated actions and procedures that are needed for smooth and safe 
operations—all this while interfacing with large numbers of airplanes and 
ground vehicles of differing makes and models that are in close proximity to one 
another. Given the complexity and intensity of the operation, it is easy to 
understand why even well-trained, highly conscientious individuals remain 
vulnerable to error, especially when faced with unusual or unexpected situations. 
Runway incursions are invariably the result of human error. With expected 
growth in air traffic over the next several years likely to exceed planned capacity 
requirements, even if the incursion rate is reduced or held steady, the absolute 
number of these events could increase over time. 

Since runway incursions result from human error, be it associated with ATC, 
aircrew, or airport design, it would be beneficial to review some of the jobs and 
tasks involved with conducting airport operations so that one can get a better 
understanding of which task elements have the greatest potential to cause errors. 
Airport ground operations are managed by air traffic controllers, pilots, and 
airport personnel. These groups jointly manage aircraft; coordinate vehicular 
traffic; and monitor and maintain conditions of runways, taxiways, aprons, signs, 
markings, and lighting. 

Controllers serve as the hub for the entire operation. Issuing clearances, 
instructions, and advisories to pilots and other ground vehicle operators, 
controllers guide all traffic that operates on the aprons, taxiways, and runways. 
Controllers monitor the surface conditions together with the identity, location, 
and movement of aircraft and other vehicles by looking out through the tower 


windows. Pilots for their part use airport layout maps, surface taxiway/runway 
signs, markings, and lighting that they observe from the flight deck to guide 
them from the runways to the gates and back. Pilots and controllers rely 
primarily on visual feedback to maintain situation awareness and separation. 
Vehicle operators manage baggage, fuel, catering, and miscellaneous ground 
handling functions. They are required to follow controllers’ instructions to 
maneuver, especially if they have to cross runways. A sampling of vehicles 
required at most airports includes the following: 


e Fuel trucks for aircraft refueling. 


e FAA vehicles for monitoring and maintaining navigation equipment, radars, 
visibility-measuring equipment, and certain lighting systems. 


e Airport authority vehicles to check for foreign objects and monitor runway 
conditions. 


e Maintenance vehicles. 
e Snowplows and mowers for maintaining runways and surrounding areas. 
e Baggage, catering, and utility trucks for flight service. 


e Emergency vehicles for crash and fire rescue. 
e Construction vehicles for maintaining airport surfaces or new construction. 


As can be seen from the preceding discussion, there is ample opportunity for 
human error given the significant combination of tasks, procedures, and 
equipment that must be coordinated to permit the operation of the system. 


TYPES OF AIRPORT SURFACE EVENTS 


Runway incursions are classified by type, typically falling into one of three 
categories as indicated below: 


e Operational Incident—a surface event attributed to ATC action or inaction. 


e Pilot Deviation—action of a pilot that violates any federal aviation regulation. 
(Example: A pilot crosses a runway without a clearance while en route to an 
airport gate). 

e Vehicle/Pedestrian Deviations—any entry or movement on the movement 
area or safety area by a vehicle (including aircraft operated by a non-pilot or 
an aircraft being towed) or pedestrian that has not been authorized by ATC. 


CONTROL STRATEGIES AND FUTURE INITIATIVES 


The FAA’s Office of Runway Safety has sponsored several initiatives to 
improve this critical safety area. In its document entitled National Runway 
Safety Plan 2015-2017, the FAA outlines several programs, which should 
further the progress of increasing runway safety over the next several years: 


SAFETY MANAGEMENT SYSTEM (SMS) IMPLEMENTATION. In 2005, ICAO 
directed its member nations to establish an SMS program at all certificated 
international airports. The FAA has taken the following steps to implement SMS 
externally and internally at more than 530 airports certificated under FAR Part 
139: 


e The latest FAA’s notice of proposed rulemaking was issued in July 2016. The 
FAA now proposes to require an SMS only for those airports classified as a 
small, medium, or large hub airport. 

e FAA has issued Advisory Circular 150/5200-37 (series) to introduce SMS to 
U.S. airports. Runway safety will remain a top priority for FAA using the four 
SMS components of Safety Policy, Safety Risk Management, Safety 
Assurance, and Safety Promotion. Additional information on the SMS process 
will be provided in Chapter 12. 


CURRENT TRAINING AND EDUCATIONAL OUTREACH PROGRAMS: 
e Quarterly air traffic controller refresher training at every control tower. 
e Pilot training and instruction during flight instructor review clinics and during 
flight reviews to increase situational awareness. 


e Utilization of the FAA Safety Team and the AOPA Air Safety Foundation to 
promote educational programs including runway safety videos at both the 
national and regional levels. These outreach programs will train general 
aviation pilots in runway safety principles. 


e Runway Safety Action Teams have been established to develop action plans 
for specific local airports. 


e FAA promotion of industry association and ICAO runway safety seminars 
such as the Global Runway Safety Symposium in Montreal, Canada (May 
2011). 


TECHNOLOGY DEVELOPMENT TO CONTROL RUNWAY INCURSIONS: 
e Airport Movement Area Safety System (AMASS) has been installed at the 


nation’s top 34 airports to provide an automatic visual and audio alert to 
controllers when the system detects potential collisions. 


e Airport Surface Detection Equipment, Model X (ASDE-X) is being deployed 
at 35 of the busiest U.S. airports to provide precise surface detection 
automatically using a combination of radar, transponder, and ADS-B 
technology. 


e Runway Status Lights (RWSL) are being deployed at 22 large airports. RWSL 
are red lights embedded in the pavement to signal potentially unsafe 
situations. 


e Final Approach Runway Occupancy Signal (FAROS) is designed to provide a 
visual alert of runway status to pilots in flight by automatically flashing the 
Precision Approach Path Indicator (PAPI) lights whenever a runway is 
occupied. 


e Electronic Flight Bag (EFB) with Moving Map Displays. Using this new 
technology, pilots are able to see exactly where their aircraft is on the airfield. 


LOCAL AIRPORT SOLUTIONS As previously discussed, the FAA encourages 
development of runway safety initiatives at the local level to solve problems that 
are unique to a particular airport. In addition, participation in information 
sharing at the regional, national, and global levels is encouraged so that 
successes and lessons learned in one locale can be applied with changes, where 
appropriate, to other regions. Local airports and regions are encouraged to 
maintain and update a central information source of newly implemented 
corrective actions and their effectiveness in preventing runway incursions. To 
promote safer ground operations, the FAA offers all airports the ability to create 
their own Web sites on which they can post airport-specific information and 
advisories. Informative booklets on airport basics, operations at towered and 
non-towered airports, phraseology, and emergency procedures are also readily 
available from the FAA. 


RUNWAY EXCURSIONS 


Unlike the unintentional penetration of a runway’s protected areas during ground 
operations, runway excursions are different phenomena altogether and have to 
do more with aircraft control during the takeoff and landing phases of flight. The 
public sometimes associates these events with “running out of runway” during 
landing, but as the case study in this chapter will illustrate, the phenomena can 


also be associated with takeoffs. The FAA defines runway excursions in the 
National Runway Safety Plan 2015-2017 as, “a veer off or overrun from the 
runway surface.” Examples of factors associated with runway excursions include 
the following: 


e Aircraft that reject their takeoff at speeds above their computed maximum for 
such operations, perhaps due to a detected malfunction, and which are unable 
to stop in the available runway. 


e Aircraft that reject their takeoff at speeds below their computed maximum for 
such an operation, but which mistakenly do so for reasons associated with 
malfunctions to their systems that affect their braking ability, such as 
hydraulic or anti-skid failure annunciations. 


e Unstable approaches that result in delayed or excessively fast touchdowns and 
from which aircraft are unable to stop on the remaining runway. 


e Landing at wrong airports, wrong runways, or even mistakenly landing on 
taxiways believing that it is a runway, in which insufficient length exists on 
the surface to allow aircraft deceleration prior to stopping. 


e Losing directional control of an aircraft during takeoff or landing, possibly 
due to runway contamination, such as ice; hydroplaning; or an asymmetric 
thrust condition, such as what is associated with the failure of an engine. 


e Miscalculated aircraft performance data that indicate the aircraft has sufficient 
runway to takeoff or land, sometimes associated with improper data entry into 
automated performance calculation systems. 


ASRS EXAMPLES 


The airport ramp is a very busy place, as there are multiple activities 
simultaneously occurring to get planes in and out of the airport. The ASRS 
examples below show how the fast-paced environment can have an impact on 
safety. 


RAMP SURFACES 
Title: Concrete parking pad causing taxiing difficulty. 


Three minutes after landing in Richmond, VA, while taxiing to our assigned Gate, we shut down Engine 
2, and continued to single-engine taxi, per Company Policy. As we approached the gate the First Officer 
(Pilot Monitoring) and I (Pilot Flying) confirmed that all ground equipment was outside the footprint of 
the ramp area for the gate. We approached at a taxi speed of approximately 5 knots, while being directed 


by the Marshaller, with a wing walker on the left and a wing walker on the right. 


At approximately 5 to 10 feet prior to reaching the parking position, the aircraft main tires met with a 
significant change in the ramp surface level where the ramp surface changes from asphalt to a concrete 
pad. In other words, there seemed to be a significant “lip” from the edge of the asphalt to the edge of the 
concrete parking pad used for parking aircraft. When the aircraft main tires reached this point of 
transition from the asphalt to the concrete at a speed of approximately 5 knots or less, the aircraft 
stopped its forward progress and began to move backwards, whereupon the aircraft brakes were applied, 
and the aircraft stopped. At this point, the aircraft was not yet at the correct parking position. The 
Marshaller continued to direct us to move forward and thrust was increased on Engine 1 to attempt to 
move forward across the “lip” between the asphalt ramp and concrete pad. With only Engine 1 
operating, we were not able to move the aircraft forward to the correct parking position without using 
more than the maximum breakaway thrust of 40% N1. An announcement was made to the passengers and 
instructions given to remain seated with seat belts fastened until Engine 2 was restarted and the aircraft 
was properly positioned at the gate. With the aircraft stopped and the parking brake set, we signaled to 
the Marshaller that we were starting Engine 2. 


After starting Engine 2, the Marshaller began to direct us to the proper parking position. With both 
engines running, maximum breakaway thrust on both engines (and possibly more) was needed to move 
the aircraft across the “lip” between the asphalt portion of the ramp area and the concrete parking pad 
to the proper parking position as directed by the Marshall[er]. 


The event occurred due to a taxi speed not adequate to allow the aircraft to transition from the asphalt 
portion of the ramp to the concrete portion of the ramp used as the parking pad. Following this event, 
after speaking with a Company Customer Service Representative in Richmond, it was learned that repair 
work to the ramp area in question had been performed on more than one occasion, due to similar events 
occurring with other aircraft parking at Gate. It is evident that this may be an ongoing issue and 
concern, at least at this particular gate in Richmond. 


In addition, this flight segment to Richmond departed late due to an earlier flight we operated in arriving 
over one hour late. While sensing a need to get the customers to the gate after landing in Richmond, 
because the flight departed late and arrived in Richmond late (i.e. “rush to comply”), excessive thrust 
was used in an attempt to get the aircraft to the parking position and avoid any further delay. 


Following this event, after careful review and consideration, I am concerned that the course of action 
taken by me (Pilot Flying) was not in the best interest of safety, especially with regard to the protection 
of Company personnel and equipment. While being directed by the Marshaller toward the parking 
position, and while attempting to taxi across the “lip” between the asphalt portion of the ramp and the 
concrete parking pad using maximum breakaway thrust (and possibly an exceedance of maximum 
breakaway thrust) first with one engine operating, and then with both engines operating, serious injury to 
ramp personnel, FOD damage to the aircraft engines, and damage to ground equipment in front and 
behind the aircraft, could have occurred. Thankfully, no personnel were injured, no FOD damage 
occurred in either engine, nor was there any damage to ground equipment in front of or behind the 
aircraft. 


In the future, the primary suggestion to myself, or anyone else, to avoid a reoccurrence of this event, or 
any similar event, is as follows: When an amount of thrust equal to maximum breakaway thrust is not 
sufficient to move the aircraft into the proper parking position: 


1. Do not exceed maximum breakaway thrust in an attempt to reach the 
parking position. 
2. Set the parking brake. 


3. Coordinate with Operations/Ground Crew to be towed to the parking 
position. 


4. If required by Company or Local Policy/Procedure, or if requested by 
Operations or the Ground Crew, shut engine(s) down prior to towing. 


Discussion question for the reader: If you managed the airfield where this 
incident occurred, what would you do to prevent a recurrence of the situation? 


PESKY GROUND VEHICLES 
Title: Ground vehicles failing to yield to aircraft during taxi. 


LAX Ramp Tower cleared us to push back. After both engines were started and after the salute/end 
marshaling signal, the First Officer obtained clearance to taxi to the top of the alleyway. I observed a 
white van disappear behind the FO’s side window. The van appeared to be on our side of the solid white 
line depicting the boundary of the alleyway. As I slowed the aircraft to a stop, the van disappeared and a 
white pickup truck following the same path stopped abeam the First Officer’s side window. The FO 
advised Ramp Tower that we would like all of the ground equipment to move to the terminal side of the 
white line before proceeding with our taxi. We were stopped for about 20 minutes while one vehicle after 
another drove into that same spot and stopped apparently oblivious to our attempt to taxi out of the 
alleyway. After the [first] truck was a catering truck and then a lavatory service truck. Ramp Tower 
called the company with no help and finally called Airport Operations who sent a sedan with hazard 
lights to chase the ground vehicles out of the aircraft taxi path. 


LAX [airport diagram] notes that the alleyway is extremely congested and confined. It cautions there is 
an “extreme jetblast hazard area” and aircraft must remain on the taxiway centerline. The wing tips are 
not practically visible during taxi from the 757 flight deck. There are reference points to predict the path 
of the aircraft structure, and some of the vehicles appeared low enough and some appeared far enough to 
avoid collision. However, with at least half a dozen ground vehicles of all different sizes driving and 
parking fully on our side of the solid white boundary lines there was no way to determine with certainty 
that ground collision could be avoided or that the drivers were assuring that. So, I did not move the 
aircraft until all of these vehicles were on the terminal side of the white line. In that 20 minutes numerous 
aircraft were delayed both inbound and outbound. The drivers and ground employees on foot all seemed 
oblivious and most never even looked toward our aircraft. They all appeared preoccupied with their own 
duties. 


Discussion question for the reader: If you were a safety manager for the 
airline that experienced this incident, what different actions would you take to 
prevent a recurrence of the situation? 


RUNWAY INCURSION 


Title: Air traffic controller mentions how airport design led to a runway 
incursion. 


It may help to refer to Figure 9-6 and trace what occurred with a pencil when 
reading about this event. This incident occurred at Los Angeles International 
Airport in California. The expression “rolling out” is used to describe a 
decelerating aircraft after landing touchdown. 
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FIGURE 9-6 LAX Airport diagram. (Source: FAA) 


Narrative from air traffic controller: 


I cleared Aircraft Y for takeoff on Runway 24L. Aircraft X was rolling out on Runway 24R. I took care of 
other things, and next thing I observed was Aircraft X was about to cross the runway while Aircraft Y 
was rolling one third down the runway. I yelled out “Aircraft X stop” “Aircraft X hold” then I instructed 
Aircraft Y to abort and cancel take off clearance. I did not cross Aircraft X, I had not expected Aircraft X 
to cross the runway. I expected all aircraft to hold short of the parallel runway, since there is enough 
space to clear the runway they just landed. Aircraft Y had to sit on the runway for about 10 minutes to 
check his aircraft (with help of rescue department) and taxied off the runway on his own. We need the 
center taxiway between Runway 24L and Runway 24R. Better educate foreign pilots to what they can and 
cannot do after landing. 


Narrative from the departing aircraft that had to abort takeoff: 


Cleared for takeoff 24L E8 shortened. As we taxied onto runway, an aircraft was rolling out on 24R. We 
began the takeoff roll as the aircraft was exiting onto AA. After 80 kt callout the CA questioned whether 
the aircraft was stopping short of 24L. We both noted that the aircraft was not stopping and the Captain 
called to abort the takeoff at approximately 110 kts. Immediately thereafter, tower told the crossing 
aircraft to “stop, stop” and called for us to abort the takeoff. The traffic had not received a clearance to 
cross 24L but failed to hold short of the runway. After the rejected takeoff, we remained on the runway 
until ARFF inspected [us] for damage. No damage noted. Returned to gate for further inspection by 
maintenance. 


Discussion questions for the reader: Why would the presence of a center taxiway 
between Runway 24L and 24R reduce the chances of a runway incursion? What 

type of damage would ARFF search for on an aircraft after a high-speed rejected 
takeoff? 


CASE STUDY: PSA AIRLINES FLIGHT 2495 


As has been shown throughout this book, the safety value chain that protects 
commercial aviation against accidents and serious incidents is long and has been 
developed over a century of effort. It extends from the design of aircraft and 
airports all the way to the training of frontline personnel, such as air traffic 
controllers and pilots. The elements of the safety value chain work well together, 
and sometimes one protection will kick in when another one fails. The case 
study contained in this section is a perfect example. 

PSA Airlines Flight 2495 illustrates how the conscientious actions that 
airports take to improve safety can truly be lifesavers when safety breaks down 
in other areas. On January 19, 2010, a PSA Airlines Bombardier CRJ 200 jet 
was scheduled to depart from Yeager Airport in Charleston, West Virginia for 
Charlotte, North Carolina. Everything leading up to the takeoff on Runway 23 
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seemed normal. However, when the puots reacned the ðu Knot Callout, tne 
captain realized that the flaps were not configured properly on the plane. He 
tried to correct the settings of the flaps, but this prompted an airplane warning. 
As a result, the captain decided to abort the takeoff. 

The plane was unable to stop within the runway confines and was forcibly 
stopped 130 feet into the 455-foot-long Engineered Materials Arrestor System 
(EMAS). EMAS is a safety measure used in locations where there is not enough 
space to have a standard 1,000 foot overrun for aircraft. It is made of crushable 
concrete that collapses under the weight of the plane, thus stopping the aircraft’s 
motion to prevent a crash or running off the runway. Figure 9-7 shows the PSA 
Airlines plane shortly after being stopped by the EMAS area at Yeager Airport. 


— 


FIGURE 9-7 Concrete blocks from the EMAS crushed under the weight of the PSA Airlines plane. 
(Source: NTSB) 


All 34 passengers left the accident uninjured, and despite the appearance of 
the jet in Figure 9-7, there was only minor damage to the plane’s flaps, landing 
gear, and landing gear doors. However, had it not been for the EMAS, the 
severity of the accident would have been much worse, probably even fatal. 
Having the EMAS in place offered the protection that the airplane needed 
against the runway overrun. 

What makes this accident unique though is that Yeager Airport is built on the 
top of a cleared mountain. When the airport was planning an airport runway 


extension project to comply with new FAA regulations, they were faced with a 
particular challenge. There was not enough room to extend the runway the 
required distance since there was a steep slope that consisted of loose sediments 
rock. As a result, the Central West Virginia Regional Airport Authority had to 
make special considerations to ensure that aircraft had a big enough safety area. 
Thus, the Airport decided that they needed to construct an EMAS. Prior to the 
installment of the EMAS in 2007, the runway safety area was only about 120 
feet long. Had this still been the case, the PSA Airlines plane would have 
endured a different fate. Figure 9-8 shows an airport diagram for Charleston and 
a close-up of a part of the diagram depicting the location of the EMAS on the 
departure end of Runway 23. 
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FIGURE 9-8 Close-up of what EMAS looks like on an Airport Diagram. (Source: FAA) 


This accident highlights the importance of addressing safety risks in a 
complex environment. These tasks require careful considerations by 
professionals in the industry. As we can see with the case study, the airport was 
aware of the implications involved with a runway that ended right before a steep 
drop-off. Their effort to install an EMAS shows how they proactively turned this 
unsafe condition into a safe environment. Even though at the time of the 
accident, one 2-foot-thick, 4-by-4 foot block used in the EMAS system cost 
around $1,000 each, it was well worth the repair costs when you consider 
everyone left the accident uninjured. 


CONCLUSIONS 


As this chapter has illustrated, there are diverse and complex activities 
happening simultaneously at any airport open to commercial aviation operations. 
Airports involve everything both inside the airport building and on the ramp, 
extending out to the runways and even the areas adjacent to the airport when 
considering wildlife hazards. Due to this vast purview, airports must be designed 
and operated with several lines of defenses for safety. All of them together add 
greatly to the safety value chain for commercial operations. 

Airport certification, as outlined in FAR Part 139, entails achieving an 
Airport Operating Certificate (AOC) and then being subject to periodic and 
occasional no-notice inspections by the FAA. Fully certificated airports must 
maintain an Airport Certification Manual (ACM) that stipulates, among many 
requirements, having an updated Airport Emergency Plan. The plan must be 
reviewed at least annually, and for Class I airports there must be a full-scale 
exercise of the plan every 3 years. 

Detailed procedures must be created and followed to manage risks associated 
with the varied operations found at airports, ranging from ARFF response 
capabilities to the storing and handling of flammable and combustible liquids. 
Fuel safety is a key responsibility of airports, both from the perspective of 
airport employees and the commercial operations that they service. Fuels can 
affect the central nervous system of ground personnel by causing narcosis 
through exposure. As for aircraft, in much the same way that blood poisoning 
can cause a human to die, a perfectly functioning engine can be rendered 
completely unusable, sometimes in mid-flight, due to fuel contamination. 

Civil aviation’s worst disaster was at Tenerife in 1977 due to a runway 
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incursion, but tnanktully incursions are rare, and incursions leading to COLLIsions 
that result in deaths are even more infrequent. Numerous initiatives have been 
established to mitigate the risk of runway incursions and, of more recent 
attention, runway excursions. 

The case study of PSA Airlines Flight 2495 illustrates how one safety system 
can make up for a deficiency in another part of aviation operations. Regulatory 
guidance, such as contained in FAA FAR Part 139, is indeed critical to the 
aviation safety professional and sets the standard for modern commercial airport 
safety systems. 
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Airport Operating Certificate 

Airport Surface Detection Equipment, Model X (ASDE-X) Airport Movement 
Area Safety System (AMASS) 

American Conference of Governmental Industrial Hygienists (ACGIH) 
American National Standards Institute (ANSI) 
CertAlerts 

Electronic Flight Bag (EFB) 

Engineered Materials Arrestor System (EMAS) 

FAA Advisory Circulars 

Final Approach Runway Occupancy Signal (FAROS) 
Grounding 

National Fire Protection Association (NFPA) 
Operational Incident 

Pilot Deviation 

Runway Incursion 

Runway Status Lights (RWSL) 

Vehicle/Pedestrian Deviation 


REVIEW QUESTIONS 


1. Which act was responsible for initiating the airport certification process and 


what were its salient features? 
2. What FAA FAR part number regulates airport certification? What are its 
highlights, and when was it first promulgated? 
3. Discuss the highlights of the airport certification process and their 
significance. 
4. What are the four classes of airport certifications and what are their 
differences? 
What is the Airport Certification Manual and why is it so significant? 
List at least five elements required in the Airport Certification Manual. 
List and explain the required elements of an Airport Emergency Plan. 
List five safety hazards associated with each of the following: 
a. Airport terminal buildings 
b. Hangars and maintenance shops 
Ramp operations 
. Aviation fuel handling 
Aircraft rescue and firefighting (ARFF) 
f. Deicing and Anti-icing 
9. What is a runway incursion? 
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10. List and explain the different categories of runway incursions. 

11. Differentiate between runway excursions and runway incursions. 

12. List individual groups together with their functions and the equipment they 
use for airport surface operations. 

13. Explain why aircraft deicing may be required even in temperate climates 
such as in Los Angeles. 
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LEARNING OBJECTIVES 


After completing this chapter, you should be able to 


e Describe the mission of the FAA ATC and discuss major milestones of ATC 
history. 


e Explain the basic components of the ATC system and ATC services available. 
e Discuss the advantages of GPS and satellite-based navigation. 

e Explain the purpose of the WAAS GPS augmentation systems. 

e Give examples of recent operational planning improvement programs. 


e Describe the general features of the NextGen Air Transportation System. 
e Discuss recent FAR Part 107 regulations regarding Unmanned Aircraft 
Systems. 


INTRODUCTION 


While some of the previous few chapters in this book focused on how aircraft 
and airports are designed for safety, once commercial flights become airborne 
they navigate through what is often highly complex airspace and rely on an 
intricate air traffic system and human controllers for separation and sequencing. 
We have come a long way since pilots used to navigate by light from signal fires 
and land on runways at night using the illumination of headlights from cars. 
However, we still have a long way to go to efficiently accommodate the 
expected growth in air traffic with NextGen and Unmanned Aircraft Systems 
under constant development. 

According to the FAA’s Air Traffic by the Numbers Web site (FAA.gov, 
2016), there are 7,000 aircraft in the sky over the United States at any given 
time, resulting in 23,911 commercial flights that fly over 2.2 million passengers 
each day, all of which are directed by 14,000 air traffic controllers. The mission 
of the Air Traffic Control (ATC) system is to promote the safe, orderly, and 
expeditious flow of aircraft through the nation’s airspace. Today’s National 
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infrastructure requiring thousands of employees and billions of taxpayer dollars 
to administer. 

Once a commercial airliner is airborne and into the airspace, crews constantly 
assess factors such as aircraft weight, fuel burn, winds aloft, cloud buildups, and 
turbulence in order to optimize their route and altitude. This results in frequent 
requests to ATC for changes which must be balanced against potential conflicts 
from other traffic in the immediate airspace. Often the results are of short 
duration, such as pilots desiring to deviate laterally to avoid a cloud buildup that 
may contain severe turbulence and then returning to the pre-agreed flight path 
once past the buildup. In other cases, the requested deviations may be 
significant, such as a descent to a lower altitude due to the need to operate anti- 
ice systems that reduce the available thrust to engines and make maintaining the 
current altitude untenable. 

To manage the airspace and its traffic, modern air traffic controllers rely 
heavily and increasingly on new Next Generation (NextGen) ATC technologies, 
as shown in Figure 10-1. These advancements are increasing with major reliance 
on the Global Positioning System (GPS) navigational tools available. It is 
anticipated that the role of modern ATC professionals will continuously evolve 
as automation increases, much in the way that the role of the aviator was shown 
to be evolving in Chapter 4 of this book. A short history of the U.S. ATC system 
is helpful to understand its current state. Here we examine the history that has 
brought us the ATC system of today, some of the basic components of the 
system, recent improvements, and current efforts to take ATC into the future. 


FIGURE 10-1 Air traffic controller using NextGen technology. (Source: FAA) 


MAJOR MILESTONES OF ATC HISTORY 


e June 1956. Midair collision over the Grand Canyon in Arizona, killing all 128 
occupants of the two airplanes, a TWA Super Constellation and a United Air 
Lines DC-7. The accident happened in clear weather under visual flight rules 
(VFR) in uncontrolled airspace. Such sightseeing detours over the Grand 
Canyon were a common practice at the time. The accident highlighted that 
much of the airspace in the United States was uncontrolled without radar 
above 20,000 feet. It also spawned the overhaul of ATC operations, 
introducing modern radar systems, requirement of the flight data recorder in 
airplanes, and the development of the FAA. 


e December 1960. The FAA was only 2 years old when another disastrous 
midair collision occurred over New York City. A TWA Super Constellation 
and a United Air Lines DC-8, both in a holding pattern under instrument flight 
rules (IFR), collided killing all aboard. The United Air Lines aircraft had 
navigational problems and excessive speed, which could not be detected by 
the New York ATC towers that lacked proper surveillance radar equipment. 
As a result of the accident, there were equipment upgrades and a new 


regulation mandating the limit of 250 knots airspeed when within 30 nautical 
miles of the airport and below 10,000 feet altitude. 


e August 1981. Over 12,000 U.S. air traffic controllers went on strike over labor 
conditions and were fired by the FAA. It took almost 10 years before overall 
ATC staffing levels returned to normal. 


e January 1982. The FAA released the first NAS Plan, a comprehensive 20- 
year blueprint to modernize ATC and air navigation systems in the United 
States. 


e April 2000. Creation of the FAA Air Traffic Organization (ATO), a 
performance-based department focusing on efficient operation of the U.S. 
ATC system. 


e December 2003. Next Generation Air Transportation System (NextGen) 
concept was authorized, a new, ambitious, multiagency effort to develop a 
modern air transportation system for the 21st century. This system faces 
significant challenges changing ATC from a radar-based to a satellite-based 
navigation and communication system. 

e Today. NextGen development continues based on GPS and computer science 
technology. The advent of Unmanned Aircraft Systems (UAS), aka “Drones,” 
is creating a paradigm shift in ATC challenges. 


The following section will discuss the fundamental components of the U.S. 
ATC system. A detailed discussion of this subject would require many chapters 
and, therefore, is outside the scope of this textbook. Since this area is changing 
rapidly, we recommend readers to consult the latest FAA and ICAO Web sites 
for more information. 


BASIC COMPONENTS OF THE ATC SYSTEM 


AIRSPACE CLASSIFICATION 


In the United States, the FAA has designated four categories of airspace as 
follows: 


e Positive controlled airspace. These are areas in which the FAA is responsible 
for separation of all aircraft, whether under VFR, see and avoid, or IFR. 
Examples of positive control areas are high-density airports and very high 
altitude flights above 18,000 feet mean sea level. 


e Controlled airspace. Areas in which ATC separates IFR traffic, but VFR 


pilots provide their own separation, weather permitting. 


e Uncontrolled airspace. The pilots themselves provide all aircraft separation; 
ATC services are not provided by the FAA. 

e Special use airspace. Areas where air traffic may be prohibited or restricted 
with special rules such as the airspace around the White House in 
Washington, D.C. 


Airspace classifications and communication requirements are taught in basic 
flight training, which are beyond the scope of this textbook. 


ATC SERVICES 


The basic communication and Navigational Aids (NAVAIDS) to aviation have 
changed little since the 1970s. Air traffic controllers operate primarily from three 
types of facilities. These basic ATC facilities are as follows: 


e Airport traffic control towers (ATCTs) 


e Terminal radar approach control (TRACON) facilities 
e Air route traffic control centers (ARTCCs) 


Some of the basic NAVAIDS and radar surveillance equipment used in this 
system are the following: 


e VHF Omni-directional Range (VOR) and Distance Measuring Equipment 
(DME) stations which transmit signals along “airways,” highways in the sky, 
to route air traffic. 


e Instrument Landing System (ILS), which is a precision approach and landing 
aid that normally consists of a localizer, a glide slope, marker beacon, and an 
approach light system. 

e Airport Surveillance Radar (ASR), used in conjunction with a transponder 
radar beacon device, is an approach control radar system used to separate 
aircraft within the immediate vicinity of an airport; it normally has a 
maximum range of 60 nautical miles. 


PERFORMANCE-BASED NAVIGATION (PBN) 


The arrival of GPS navigation tools has caused a major restructuring of ATC 
procedures. The FAA has recently announced its strategic goal to make PBN the 


nation’s primary means of navigation in the next 15 years. An in-depth 
discussion of PBN is beyond the scope of this textbook, so we will only discuss 
the highlights. In general the area of performance-based navigation (PBN) can 
be divided into two major sub areas: 


1. Area navigation (RNAV) is a term describing different technologies that 
enable aircraft navigation on any desired course within the coverage of 
specific navigation signals. RNAV may consist of station-to-station 
navigation, or it may be between random waypoints offset from published 
routes depending upon the type of equipment used. Basically, RNAV will 
develop in the coming years as a GPS-dependent system, independent of 
the many VOR/DME navigational aids that will slowly be phased out as 
part of the NextGen FAA modernization program. 


2. Required navigation performance (RNP) is a type of PBN that allows an 
aircraft to fly a specific path between two 3D-defined points in space. Area 
navigation (RNAV) and RNP systems are fundamentally similar, the key 
difference between them is the requirement for RNP onboard performance 
monitoring while flying curved approach paths to an airport. This 
navigational program is growing as airports and aircraft are configured for 
this type of precision approach. 


GPS ENHANCEMENTS 


For many years, the U.S. aviation navigation system was composed of ground- 
based systems whose signals were used by aircraft avionics for en route 
navigation and landing guidance. Despite the large number of ground systems, 
navigation signals did not cover all airports and airspace. Over the next several 
years, the aviation navigation system is expected to greatly increase its use of 
GPS satellites to provide navigation signal coverage throughout the NAS. 

Global Positioning System is a space-based positioning, velocity and time 
system, developed and operated by the U.S. Department of Defense and 
composed of space, control, and user segments. The space segment is composed 
of 21 satellites (plus three operational spares) in six orbital planes. The control 
segment consists of five monitor stations, three ground antennas, and a master 
control station. The user segment consists of antennas and receiver-processors 
that provide positioning, velocity, and precise timing to the user. 

Reliance on ground-based navigation aids will decline as satellite navigation 
provides equivalent or better levels of service. A transition to satellite navigation 
significantly expands navigation and landing capabilities, improving safety and 


efficient use of airspace. In addition, it will reduce the FAA’s need to replace 
many aging ground systems, decrease the amount of avionics required to be 
carried in aircraft, and simplify navigation and landing procedures. 


WIDE AREA AUGMENTATION SYSTEM 


Wide Area Augmentation System (WAAS) is an extremely accurate navigation aid 
developed for civil aviation to augment the Global Positioning System. Before 
WAAS, the U.S. National Airspace System (NAS) did not have the potential to 
provide horizontal and vertical navigation for approach operations for all users at 
all locations. With WAAS, this capability is a reality. WAAS provides service 
for all classes of aircraft in all phases of flight including en route navigation, 
airport departures, and airport arrivals. This includes vertically guided landing 
approaches in instrument meteorological conditions at all qualified locations 
throughout the NAS. 


ADVANTAGES OF SATELLITE-BASED NAVIGATION 


Satellite-based navigation provides significant operational and safety benefits 
over past methods that relied on ground-based navigation aids. The new mode of 
navigation meets the needs of growing operations because pilots will be able to 
navigate virtually anywhere in the NAS, including to airports that currently lack 
ground navigation and landing signal coverage. Satellite-based navigation will 
support PBN direct routes. With satellite navigation, the number of published 
precision approaches has also greatly increased so that in addition to actually 
finding airports pilots can also successfully land there during inclement weather 
conditions. In addition, combining GPS with flight deck electronic terrain maps 
and ground-proximity warning systems can help pilots reduce flight profiles that 
expose them to controlled flight into terrain (CFIT). 

Satellite-based navigation also decreases the number of ground-based 
navigation systems, thereby reducing infrastructure costs. For a precision 
approach today, each runway end needs a dedicated ILS. GPS/WAAS can 
provide the precision approach guidance for most of the runways in the NAS 
using RNAV and RNP procedures which are quickly expanding across the 
country. 


TERMINAL AUTOMATION MODERNIZATION AND REPLACEMENT (TAMR) 


The FAA’s terminal automation modernization and replacement (TAMR) 


program is upgrading ATC systems at terminal radar approach control 
(TRACON) facilities across the national air space (NAS) with the Standard 
Terminal Automation Replacement System (STARS) platform. TAMR will 
combine and upgrade ATC technologies to the STARS which is a single, state- 
of-the-art platform that will be installed at TRACONS and control towers. When 
fully operational, the STARS system will perform as follows: 


e Maintain safety while increasing cost-effectiveness at terminal facilities 
across the NAS. 


e Provide advanced functionalities for controllers, such as state-of-the-art flat- 
panel LED display and the ability to save controller workstation preferences. 
e Offer maintenance improvements to keep equipment up and running. 


Terminal automation systems receive surveillance data and aircraft flight plan 
information. Controllers at radar control facilities use these systems to manage 
air traffic immediately around major airports, and technicians maintain these 
systems at facilities. These systems enable controllers to provide the following 
ATC services that are critical to the safety of the national airspace: 


e Separating and sequencing of aircraft 
e Conflict and terrain avoidance alerts 


e Weather advisories 
e Radar vectoring for departing and arriving traffic 


UPDATE ON FAA NEXTGEN BACKBONE PROGRAMS 


Through its NextGen program, the FAA has taken major steps to enhance safety 
and improve efficiency in our nation’s airspace. NextGen is a comprehensive 
modernization of state-of-the-art technologies and procedures that, in short, 
enable aircraft to move from Point A to Point B more efficiently and directly 
than ever before. This is truly a “work in progress,” so for the latest information 
on FAA NextGen programs, the reader is urged to visit the FAA Web site. 

The major backbone programs of NextGen include the following: 


e Automatic Dependent Surveillance—Broadcast (ADS-B) is FAA’s satellite- 
based successor to radar. ADS-B makes use of GPS technology to determine 
and share precise aircraft location information and streams additional flight 
information to the cockpits of properly equipped aircraft. The FAA has set a 


goal that ADS-B will be fully operational by the year 2020. U.S. airlines are 
on track to meet this goal; however, the general aviation industry is struggling 
to meet this deadline date. 


Collaborative Air Traffic Management Technologies (CATMT) is a suite of 
enhancements to the decision-support and data-sharing tools used by air 
traffic management personnel. These enhancements will enable a more 
collaborative environment among controllers and operators, improving 
efficiency in the National Airspace System. 


Data Communications (Data Comm) will enable controllers to send digital 
instructions and clearances to pilots rather than relying solely on voice 
communications. Precise clearance messages from ATC that appear on a 
cockpit display can also interact with an aircraft’s Flight Management 
Systems (FMS) computer. As of this publication, FAA control towers in over 
50 locations have installed Data Comm equipment. In the near future Data 
Comm will supplant voice communications as the primary means of 
communication between controllers and flight crews. 


National Airspace System Voice System (NVS) will supplant FAA’s aging 
analog voice communication system with state-of-the-art digital technology. 
NVS will standardize the voice communication infrastructure among FAA 
facilities, and provide greater flexibility to the ATC system. 


System Wide Information Management (SWIM) is the network backbone 
structure that will carry NextGen digital information. SWIM will enable cost- 
effective, real-time data exchange and sharing among users of the National 
Airspace System. 


NextGen Weather will help reduce weather impacts by producing and 
delivering tailored aviation weather products via SWIM, helping controllers 
and operators develop reliable flight plans, make better decisions, and 
improve on-time performance. NextGen Weather is accomplished through 
collaboration between FAA, NOAA, and NASA. The efficient handling of 
new weather products will greatly improve traffic flow management (TFM) 
throughout the National Airspace System. Terminal Flight Data Manager 
(TFDM) modernizes ATC tower equipment and processes. Using SWIM 
capabilities, TFDM will share real-time data among controllers, aircraft 
operators, and airports so they can better stage arrivals and departures for 
greater efficiency on the airport surface. The FAA currently projects that 
TFDM processes will roll out in 2019. 


AIRPORT SURFACE DETECTION EQUIPMENT, MODEL X (ASDE-X) 


As frequently noted by the FAA and NTSB, the potential for runway incursions 
and collisions on taxiways increases each year. That is due to the continuing 
increase in air traffic and the associated increased frequency of aircraft operating 
in close proximity to each other on airport surfaces. To combat this risk, the 
FAA has deployed Airport Surface Detection Equipment, Model X (ASDE-X) at 
major U.S. airports. This system allows controllers to detect potential runway 
conflicts by providing detailed coverage of movement from surface radar, ADS- 
B sensors aboard aircraft, and aircraft transponders, among other sources. This 
technology is especially useful for controllers at night or in weather conditions 
of poor visibility where airport traffic is not easy to spot visually. 


DEPARTURES AND ARRIVALS 


Resolving congestion at the busiest U.S. airports requires a combination of 
modern technology and additional runways. As depicted in Figure 10-2, 
engineers and technicians are testing airborne spacing for terminal arrival routes. 
The FAA is working with airport operators to plan and develop new runways to 
accommodate increased aircraft operations and use new technologies, while 
meeting environmental requirements. 


FIGURE 10-2 Personnel use a NextGen airborne testbed to assess potential arrival routes. (Source: NASA) 


Arriving and departing aircraft are sequenced in and out of the airport by air 
traffic controllers at the TRACON facilities. Maintaining a steady flow of 
aircraft, particularly during peak periods, can be improved by providing 
controllers with tools for sequencing and spacing aircraft more precisely so that 
more can fit into any given amount of airspace. The objective is to reduce 
variability in services and optimize use of airspace and available runways. 


EN ROUTE AND OCEANIC OPERATIONS 


The evolution toward a NextGen environment requires significant improvements 
in en route and oceanic computer systems and controller decision support tools. 
The aging automation infrastructure must be replaced before new applications 
and improved services can be provided. 

Currently, en route and oceanic facilities are co-located but do not share 
common systems, primarily because of the lack of surveillance and direct 
communications services over large portions of the oceans on Earth. The 


addition of oceanic surveillance and real-time direct communications will enable 
oceanic services to gradually become comparable with en route services, and 
oceanic and en route systems will evolve to a common hardware and software 
environment. Within both the Atlantic and Pacific airspaces, FAA controllers 
monitor aircraft position using Advanced Technologies and Ocean Procedures 
(ATOPs) equipment. 

In the domestic airspace, aircraft are monitored by radar and typically follow 
the fixed route structure of airways, which prevents pilots from flying the most 
direct route or taking advantage of favorable winds. In oceanic airspace, aircraft 
follow “tracks” that are aligned each day with prevailing winds. The frequent 
lack of radar surveillance and direct controller—pilot communications often 
requires oceanic separation standards to be 20 times greater than those in 
domestic airspace. The large separations limit the number of available tracks. 
Therefore, some flights are assigned a less than optimum altitude in order to still 
transit the airspace without undue delay, and there is insufficient opportunity to 
adjust altitudes to conserve fuel. 

Additional tracks and access to optimum altitudes would reduce fuel 
consumption and costs substantially. Reduced Vertical Separation Minimums 
(RVSM) are evolving and showing great promise. When fully operational, ADS- 
B, ATOPs, and RVSM will reduce the required aircraft separation substantially. 
This will improve the efficiency of oceanic routes and reduce controller 
workload. 


UNMANNED AIRCRAFT SYSTEMS REVOLUTION 


BACKGROUND 


A major change in the area of Airspace Safety has been the rapid growth in the 
development of Unmanned Aircraft Systems. UAS (often called “Drones” or 
UAVs) have been around for many years and have proven their value in many 
military applications. Today, entrepreneurs are exploring new and innovative 
ways to use drones for commercial purposes. Some examples of applications 
include law enforcement, package delivery, filmmaking, agriculture, search and 
rescue, security inspections, photography, real estate listings, etc., and the list 
goes on and on. The FAA estimates that the drone industry will be a huge boost 
to the U.S. economy, generating over $80 billion and creating more than 100,000 
jobs over the next 10 years. The possibilities for UAS use are endless, and we 
will undoubtedly see pressure to fully integrate drones safely into the NAS in the 
coming years. 


Section 333 of the FAA Modernization and Reform Act of 2012 (FMRA) 
granted the U.S. Secretary of Transportation the authority to determine whether 
an airworthiness certificate was required for a UAS to operate safely in the 
National Airspace System (NAS). FAA began issuing 333 exemptions in 
September 2014 as a stopgap measure to allow certain low-risk commercial 
drones to operate while the industry waited for the full regulations. Now, the 
FAA has issued a new UAS final rule to regulate the operation and certification 
of Small Unmanned Aircraft Systems (sUAS). 


FAR Part 107: THE SMALL UAS RULE (FAA SAFETY BRIEFING) 


The Small UAS rule adds a new FAR Part 107 to 14 CFR to allow for routine 
civil operation of small Unmanned Aircraft Systems (SUAS) in the National 
Airspace System (NAS) and provide safety rules for those operations. The rule 
defines small UAS as unmanned aircraft weighing less than 55 pounds. To 
mitigate risk, this rule limits small UAS to daylight and civil twilight operations 
with appropriate collision lighting, confined areas of operation, and visual-line- 
of-sight operations. 

The rule addresses airspace restrictions, remote pilot certification, visual 
observer requirements, and operational limits in order to maintain the safety of 
the NAS and ensure that small UAS do not pose a threat to national security. 
Because UAS constitute a quickly changing technology, a key provision of this 
rule is a waiver mechanism to allow individual operations to deviate from many 
of the operational restrictions of the rule if the FAA Administrator finds that the 
proposed operation can safely be conducted under the terms of a certificate of 
waiver. This new rule became effective August 29, 2016. 

It is important to note that FAR Part 107 does not apply to model aircraft like 
noncommercial drones and radio-controlled aircraft. Model aircraft operators 
and recreational drone users must continue to satisfy all the criteria specified in 
Section 336 of the FMRA, including the stipulation they be operated only for 
hobby or recreational purposes. 


FLYING DRONES COMMERCIALLY 


The new rules are long and complex, so a detailed discussion is beyond the 
scope of the textbook. Below is a short summary of the basic things an operator 
must know for flying under the small UAS rule under 14 CFR Part 107. 

Pilot Requirements to obtain a Remote Pilot Certificate: 


e Must be at least 16 years old 


e Must pass an initial aeronautical knowledge test at an FAA-approved 
knowledge testing center 
e Must be vetted by the Transportation Safety Administration (TSA) 


(Note: A person who already holds a pilot certificate issued under 14 CFR 
Part 61 and has successfully completed a flight review within the previous 24 
months can complete an approved FAA Part 107 online training course to satisfy 
this requirement.) 

Aircraft Requirements: 


e UAS must be less than 55 lb 
e Must be registered with the FAA 


Operating Rules: 


e Drone operation in uncontrolled Class G airspace OK, but otherwise must get 
permission from ATC in controlled airspace 


e Must keep the aircraft in sight (visual line-of-sight) 
e Must fly under 400 feet and only during daylight hours 


e Must fly at or below 100 mph and yield right of way to manned aircraft 
e Must NOT fly over people and must NOT fly from a moving vehicle 


(Note: These operating rules are subject to waiver which must be specifically 
justified by request from the FAA.) 


IMPACT TO AIR TRAFFIC CONTROL 


After the effective date of August 2016, the drone operators that have 
successfully passed the required knowledge test and received a remote pilot 
certificate may begin operations in Class G airspace at or below 400 AGL 
without contacting ATC or issuing a NOTAM. For operations in controlled 
airspaces (Class B, C, and D airspace, and E surface area) the Air Traffic 
Control Organization, in collaboration with National Air Traffic Controllers 
Association (NATCA), is establishing a process where the operator can make a 
request and receive approval to fly in controlled airspace through an automated 
system. For more information on the new UAS rule in this quickly changing 
area, please visit the FAA UAS Web site (www. faa.gov/UAS). 


ASRS EXAMPLES 


Air traffic controllers face many different challenges every day, regardless of 
which position they work. However, they also have the ability to improve safety 
by submitting their accounts of incidents to the ASRS or ATSAP database. 
Below are a few narratives that show the difficulties that controllers see on a 
daily basis and their dedication to making ground and air operations safe. 


AIR TRAFFIC CONTROL TOWER 
Title: Dated facilities affecting controllers’ jobs. 


Aircraft X was cleared to land on the left runway. Aircraft Y was cleared to land on the right runway. My 
trainee and I were scanning out the window for the aircraft, very difficult due to the scratched and dirty 
shades and the filthy windows. Also the radar does not differentiate which runway aircraft are lined up 
for. We saw Aircraft X over the numbers for the right runway in landing configuration. We were forced 
to send Aircraft Y around, so that we would not lose runway separation. No loss of separation occurred. 
Get new window sun screens, they are badly scratched and dirty. Clean the filthy windows. Align the 
radar so that we can tell which runway aircraft are landing on, or add a screen we can enlarge the 
picture on so we can tell which runway aircraft are lined up for. 


Discussion question for the reader: If you managed the ATC tower described 
in this incident narrative, what message would you send to your controllers 
regarding the incident in order to promote safety? 


AIR ROUTE TRAFFIC CONTROL CENTER 
Title: Separation errors resulting from fatigue. 


I was getting busy and was feeling very tired and behind the power curve right from the start. I got a 
Radar Assist position, but was not even able to get him a proper briefing because of the amount of 
workload I was handling. I did not put 27000 feet in the data tag on this aircraft. It was still showing 
29000 feet causing me to turn him right in front of another aircraft at 28000 feet; however, with the 
proper turns and pilot’s immediate actions I was able to maintain separation. I would not have been able 
to do so if that pilot was not on top of his game. He was GREAT! I have no excuses to make here. We 
have been super short staffed and with weather throughout our sectors and more than the normal amount 
of traffic through this sector I am beat and can only pray we get relief from this shortage soon before 
something worse happens. 


Discussion question for the reader: If you managed the center described in 
this incident narrative, what message would you send to your controllers 
regarding the incident in order to promote safety? 


CASE STUDY: THE 2006 MIDAIR COLLISION OVER 


BRAZIL 


Air traffic controllers are tasked with a very difficult and complex job. They 
must constantly monitor their assigned airspace while maintaining contact with 
pilots who may need route deviations, altitude changes, and speed adjustments. 
If at any point air traffic controllers are not fully cognizant of everything going 
on and not following the safeguards that have been put in place, the results can 
be fatal. Let us look at the details of an accident in Brazil to demonstrate how 
ATC is a critically important prerequisite for safety in the skies. 

On September 29, 2006, one of the deadliest accidents in Brazilian aviation 
history occurred, and many have even said that it was the most complex 
scenarios to investigate in the nation’s history. The crash involved a Boeing 737 
from Gol Transportes Airlines operating as GOL Flight 1907 and an Embrarer- 
136 with U.S. registration number N600XL, operating as an executive aircraft 
under the company ExcelAire Services. The Embraer jet had departed from Sao 
José dos Campos Prof. Urbano Ernesto Stumpf State Airport, and the Boeing jet 
had departed from Manaus Eduardo Gomes International Airport. 

While both flights were on their respective routes, they collided at Flight 
Level 370. The left wing of each aircraft made contact as they passed with a 
supersonic closure rate, just barely hitting but in the most catastrophic way, as 
depicted in Figure 10-3. The Embraer jet lost part of the left winglet, sustained 
damages in the left stabilizer, and left elevator; however, it remained controllable 
in flight and made an emergency landing at a military facility. Conversely, the 
Boeing airliner lost about one-third of the left wing in the collision, making it 
uncontrollable. The ensuing abrupt spiral dive caused the aircraft to come apart 
in flight before violently impacting the ground in the middle of the thick 
rainforest. There were no injuries onboard the Embraer jet, but there were no 
survivors on the Boeing aircraft due to the brutal crash forces. 
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FIGURE 10-3 The geometry of the midair collision. (Source: Centro de Investigação e Prevenção de 
Acidentes Aeronduticos) 


Let us examine the reasons why this midair collision occurred, many of which 
involve insufficient communication and actions by ATC. Since the safe and 
orderly flow of traffic requires a team effort that monitors and updates 
information, it is quite easy for there to be a breakdown somewhere in the 
system. The contributing factors related to ATC below highlight how lack of 
sufficient attention from only one party in the system is enough to erode safety: 


e There was an incomplete flight clearance issued by the assistant controller in 
Sao Paulo and the ground controller at São José dos Campos. This caused the 
Embraer jet pilots to believe they could maintain Flight Level 370 all the way 
to their destination despite a discrepancy with their flight plan. 


e The controller of sectors 5 and 6 in the Brasilia airspace did not provide the 
controller of sectors 7, 8, and 9 with the necessary information for handing off 


the Embraer jet. 


¢ The air traffic controller for sectors 7, 8, and 9 did not make radio contact 
with Embraer pilots to change the aircraft’s flight level and switch the 
frequency, thus losing contact with the aircraft. 


e The air traffic controller of sectors 7, 8, and 9 did not perform the necessary 
procedures for the loss of transponder and loss of radar. This enabled the 
Embraer jet to continue flying at the incorrect flight level. 


e There was lack of communication between sectors and control centers during 
the coordination and handoff. 


e There was also a lack of monitoring, advisory, and guidance associated with 
individual ATC decisions at the Brasilia area control center. 

e Standard procedures were not followed during the hand offs of both aircraft 
between controllers and also when radar contact was lost with the Embraer 
jet. 


To prevent a similar midair collision in the future, the accident investigation 
team made several recommendations for improving ATC communication and 
procedures. They included the following: 


e Instruct the air traffic controllers as to the compliance of the prescribed 
procedures regarding the air traffic clearances to be transmitted to pilots. 


¢ Ensure that all air traffic controllers fully comply with the prescribed air 
traffic handoff procedures between adjacent ATC units and/or between 
operational sectors within the unit. 


e Ensure the development of quality management programs for the ATC 
services in the various control units. 


e Ensure that the procedures prescribed for the loss of transponder signal and 
radar contact, especially within RVSM airspace, are complied with by the 
ATC units. 

e Ensure, by means of a revision of the criteria used in the evaluation of the 
performance of air traffic controllers, relative to both basic professional 
formation and radar specialization courses, that they meet the proficiency 
levels required for the exercise of the activity. 


The controllers associated with the Brazil midair collision did not identify and 
mitigate conflict in airspace, which is an essential job responsibility. In addition, 
the accident illustrates how accidents are multicausal. There was more than one 
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correct communication. For instance, the transponder is an important device for 
maintaining contact with the pilots. The controllers did not verify the 
connection, thus disrupting the safety of the airspace. Since the Embraer’s 
transponder was off, it deactivated the traffic collision avoidance system (TCAS) 
that may have prevented the collision altogether. So the controllers were only 
one element of the accident sequence of events, which could have been 
prevented through the action of others. Unfortunately, there were many factors 
working against safety that day, and we now must rely on the recommendations 
to prevent such a tragedy from happening again. 


CONCLUSION 


It is easy to forget about the role that air traffic controllers play in the aviation 
field because they are an invisible force. While walking through an airport or 
waiting on the plane, it is common to see the pilots, flight attendants, and ramp 
workers; however, the controllers sit tucked away from everyone else. Even 
though we do not see them, we must not forget the pivotal role they play in 
aviation. As this chapter has highlighted, the job of an air traffic controller has 
evolved over the past several decades. 

There has been little change in the air traffic system since the 1970s until 
recent years when the industry has started replacing antiquated technology with 
new NextGen infrastructure. We will see a shift from equipment like ground- 
based radar to new programs such as SWIM and DATACOMM under the 
NextGen framework. Likewise, the tremendous growth in UAS operations will 
continue to put stress on the ATC system. Despite all the changes, the ultimate 
goal is to increase the efficiency and effectiveness of communication between 
pilots, aircraft, and ATC. Doing so will improve processes that prevent midair 
collisions like the 2006 Brazil accident presented in the case study. Ultimately, 
everyone in the system must play their part to build the safest environment for 
our skies and ground operations that we can. Air traffic management and related 
systems serve as a key component in the commercial aviation safety value chain. 


KEY TERMS 


Advanced Technologies and Ocean Procedures (ATOPs) 
Air Route Traffic Control Centers (ARTCCs) 


Airport Surface Detection Equipment, Model X (ASDE-X) 
Airnort Surveillance Radar (ASR) 
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Airport Traffic Control Towers (ATCTs) 

Area Navigation (RNAV) 

Automatic Dependent Surveillance—Broadcast (ADS-B) 
Collaborative Air Traffic Management Technologies (CATMT) 
Controlled Airspace 

Data Communications (Data Comm) 

FAA Modernization and Reform Act of 2012 (FMRA) 

Global Positioning System (GPS) 

Instrument Flight Rules (IFR) 

Instrument Landing System (ILS) 

National Airspace System Voice System (NVS) 

Navigational Aids (NAVAIDS) 

NextGen Weather 

Performance-Based Navigation (PBN) 

Positive Controlled Airspace 

Reduced Vertical Separation Minimums (RVSM) 

Required Navigation Performance (RNP) 

Small Unmanned Aircraft Systems (SUAS) 

Special Use Airspace 

Standard Terminal Automation Replacement System (STARS) 
System Wide Information Management (SWIM) 

Terminal Automation Modernization and Replacement (TAMR) 
Terminal Flight Data Manager (TFDM) 

Terminal Radar Approach Control (TRACON) 

Traffic Flow Management (TFM) 

Uncontrolled Airspace 

Unmanned Aircraft Systems (UAS) 

VHF Omni-directional Range (VOR) 

Visual Flight Rules (VFR) 

Wide Area Augmentation System (WAAS) 


REVIEW QUESTIONS 


1. Describe how air traffic is controlled. 
2. What is the mission of the FAA’s ATC system? 


3. Identify some of the major milestones in ATC history. 

4. What are some of the key components of the ATC system? 

5. Discuss the basic differences between visual and instrument flight rules 
(VFR vs. IFR). 

6. What is the purpose of a terminal radar approach control (TRACON)? 

7. Briefly describe how GPS works. 

8. What are some of the advantages of satellite-based navigation? 

9. What is automatic dependent surveillance—broadcast (ADS-B)? 

10. Distinguish between ADS-B and ASDE-X. 

11. What are the key components of the en route/oceanic ATC system? 

12. What is NextGen and what are its goals? 

13. Describe what you believe to be the most important of the NextGen 
backbone programs and express why you made the choice. 


14. Discuss the basic provisions of the new FAA Unmanned Aircraft Systems 
Rule (FAR Part 107). 
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LEARNING OBJECTIVES 


After completing this chapter, you should be able to 


Explain why the accident rate is a better measure of safety than accident 
counts. 


Discuss considerations and caveats when analyzing and comparing 
commercial aviation accident statistics. 

Understand trends and major elements of Boeing’s Summary of Commercial 
Jet Transport Aircraft Accidents. 


e Discuss OSHA injury and illness rate statistics. 


INTRODUCTION 


In passenger transportation, safety factors (some of which are causal factors) are 
events that are associated with or influence fatality rates. A safety indicator is a 
measurable safety factor. The probability of death or injury as a result of 
traveling in a given transportation mode, when quantified, is the primary 
benchmark of passenger safety. Car accident rates also are commonly used as 
safety indicators since most passenger fatalities occur as a result of terrestrial 
vehicle accidents and not aviation ones. 

If one were to look at risk as the probability of death, then the risk due to 
traveling can be established from fatality rates. However, commercial aviation 
fatality rates are poor indicators to show change in short-term risk since a large 
jet accident can potentially result in the deaths of a few hundred people. Hence, a 
single accident can greatly influence fatality rates. Therefore, the trending of 
fatality rates requires data from extended time periods (5 years or more). As an 
alternative process, accident rates can be used instead of fatality rates as 
indicators of safety levels. The number of fatalities, even for a specific type of 
accident, varies greatly with each crash. However, while the number of accidents 
may have a narrower range of annual variance than the number of fatalities, it 
still presents challenges for analyses. While the way that accidents are defined 
may mean that there are more numbers of accidents than fatalities, modern 
commercial aviation thankfully presents few accidents making for difficult 
Statistical analyses. Also, the number of accidents in a given country, geographic 
area, or type of operation can vary significantly from one year to the next, thus 
resulting in accident rates also being poor indicators of short-term estimates of 
risk trends. 

Before using accident statistics for safety analyses, it is necessary to 
understand the denominators of exposure used to calculate transportation 
accident or fatality rates. Exposure data can be thought of as an indication of the 
amount of opportunity an event has to occur. Cycles, distance, and time for 
passengers and vehicles are the principal exposure types. They are used in the 
denominator of rates, such as fatalities per passenger departure or electrical 
system failures per flight-hour. The choice of type of exposure data will affect 
how rates are compared between and within transportation modes. We must be 
careful to only compare rates that have the same units of exposure. For example, 
it would be highly confusing to compare fatalities per departure in one year to 


fatalities per flight hour in another year. 

Passenger-miles (the number of passengers multiplied by the miles traveled) 
are most appropriate when one is comparing air transportation with other modes 
of transportation, as they allow generalized, broad-based system comparisons. 
Using trips between the same city pairs to compare risks for different modes of 
travel seems appealing at first glance; however, the number of city pairs in the 
United States is extremely large and some modes of transportation do not have 
passenger data in the format required for this type of comparison. In addition, 
risk per passenger-mile is not uniform over a trip and can vary by the type of 
route taken, by season, or the time of day. 

It is clear that the probability of an accident is significantly higher during 
takeoff or landing given the increased risk in such phases of flight over others 
such as cruise. Since the cruise phase is usually the longest part of any 
commercial flight, then most travel time occurs under a lower average risk. Such 
variation is not present during surface transportations, such as during the daily 
commute to one’s office, although specific locations may pose more driving 
hazards than others. Aviation accidents can vary greatly in severity, ranging 
from a flight-attendant back injury from pushing carts during in-flight service or 
handling overhead luggage to several hundred deaths due to an aircraft crash. To 
render a more equitable perspective on aviation risk, some databases categorize 
accidents as fatal and nonfatal. However, even when using such a process, a 
single death on a ramp during an aircraft pushback would still be classified as an 
aviation accident even though the aircraft involved in the accident is untouched. 
To address this issue, International Civil Aviation Organization (ICAO) 
classifies accidents as major, serious, injury, or damage (see definitions in 
Chapter 1). Another classification popular with insurance and aircraft 
manufacturing industries is to refer to accidents as either an (aircraft) hull loss or 
non-hull loss. A hull loss is airplane damage that is beyond economic repair, 
which implies that very serious damage was incurred. 

Accident counts by themselves cannot be reliably used to measure relative 
safety among different airlines or flight departments because there are just not 
enough accidents for statistics to be usable. Most airlines will, thankfully, not 
have a hull loss in any given year, making comparison based on such criteria 
meaningless. Small numbers of accidents, even if including all four accident 
categories used by the NTSB, may produce a false picture due to highly 
unpredictable events, such as turbulence encounters. 

Furthermore, all other considerations being equal, an airline that has a larger 
fleet of aircraft could be expected (statistically speaking) to have a larger number 


of accidents than an airline with fewer planes. Similarly, aircraft models that are 
flown more often would be expected to be involved in more accidents than less 
frequently used models. For this reason the accident rate, which is the number of 
accidents divided by some common base variable (e.g., flight hours, departures, 
and miles flown), is a more valid indicator of relative safety than just accident 
counts. In this context, time (flight hours) is a popular measure of exposure in 
many types of risk analysis. Since flight-hour data is needed for economic, 
operational, and maintenance reasons, airlines keep accurate records of such data 
which are readily available for safety rate comparisons. Also, rate data is used by 
NTSB to compare safety performances among airlines and other sectors of the 
air transportation industry. 

Even when comparing rates versus number of accidents, context must be 
considered in order to perform a fair analysis. For example, weather is often a 
factor in accidents and some airlines operate primarily in relatively benign 
weather, such as is often found in the desert southwestern United States or 
Mediterranean Europe. While others operate in very challenging weather, such 
as in Canada, Alaska, Scotland, or Scandinavia, where large portions of the year 
require operating in frozen precipitation, contaminated runways, and low 
ceilings. Another example is the variation in navigation aids and airport 
conditions faced in different parts of the world. Airlines providing service within 
Europe may expect radar control and precision approaches to long paved 
runways, whereas some airlines in South America and Africa routinely operate 
in non-radar environments to dirt runways in the jungle. 

As previously mentioned, takeoffs and landings, to include approaches, 
present more risk than other phases of flight. This is partly because there is less 
time to correct undesirable aircraft states or errors before being met with the 
unforgiving firmness of terrain or fluidity of water. If takeoffs or landings are 
used as a base for rate calculations, then the airline that predominantly flies 
several shorter routes but similar number of hours per day would be expected to 
have a higher accident rate than those flying only a few longer legs. For 
example, a twin engine turboprop aircraft flying tourists around Alaska may 
make 10 flights per day and therefore the same amount of takeoffs and landings, 
whereas a legacy airline’s Boeing 787 may make one flight per day. A safety 
analyst desiring to assess accident rates between two such operators would be 
wise to use number of landings as a denominator in the accident rate equation 
versus flight hours in order to produce a more equitable comparison. 

The air transportation industry is extremely dynamic and changes with 
technological advances, operational strategies (point-to-point versus hub and 
spoke), mergers, consolidations, and bankruptcies that all rapidly change the 


aviation landscape. The aviation industry of today is very different from what it 
was 40 years ago. For all these described reasons, one should also exercise care 
when comparing safety statistics over long periods of time. While there is no 
clear answer as to what time domain is appropriate for analyzing and comparing 
aviation safety data, the most recent 5-to 10-year span appears to be the accepted 
norm among federal regulators. 

Aviation accidents are rare occurrences, and the risk of death or serious injury 
by air travel is miniscule. With such small numbers, making statistical inferences 
from the data to evaluate safety performance of the industry is very difficult. 
Regulatory agencies and the aviation industry maintain a wide variety of safety- 
related information. However, one must take into consideration the accuracy and 
completeness of these data when developing safety trends and recommending 
control measures. Safety factors other than fatalities or accidents that include the 
nature and causes of accidents (covered in Chapter 2) should be studied and used 
for preemptive strikes against safety hazards and to provide timely feedback to 
safety managers and policymakers. 

In summary, no single measurement provides the complete safety picture. 
Passenger-exposure data are used when passenger risk is to be described. 
Passenger-miles are used when the influence of vehicle size or vehicle speed on 
the data is nonexistent. Departure-exposure data accounts for nonuniform risk 
over a trip. Time is the most widely used exposure measure, and time-based data 
are often readily available. 


AVIATION ACCIDENT AND SAFETY STATISTICS 


Chapter 7 reviewed various data reporting systems, both voluntary and 
mandatory, that are used in aviation. While ensuring compliance or consistency 
in safety reporting is difficult in general, voluntary systems have added 
complexity in that they are inconsistent and less reliable because they are subject 
to reporting bias and erroneous content. Such reports can still be highly valuable, 
of course. There are several reliable sources of accident data. One of the most 
easily accessible accident databases is maintained by Boeing, which publishes an 
annual Statistical Summary of Commercial Jet Airplane Accidents. Another 
source is the Aviation Safety Network of the Flight Safety Foundation, found at 
http://aviation-safety.net/. Finally, the definite source of aircraft accident data in 
the United States is the NTSB database. 


MANUFACTURERS’ INVOLVEMENT WITH SAFETY DATA 


Safety professionals within the airframe and engine manufacturer community 
can often be found at accident sites participating in the investigation due to their 
unique, equipment-specific knowledge. They collect data and analyze them with 
their expertise and their extensive network of fellow experts on given systems 
back at their company. They recommend improvements in the way aircraft are 
designed, built, operated, and maintained. The goal for all who participate in 
accident investigations is to learn from the event, and therefore, prevent future 
accidents. Such prevention is best accomplished when the equipment experts are 
allowed to yield their unique insights as part of the investigative process. 

While different manufacturers all participate in the investigative process 
when their respective equipment is involved, organizations are often organized 
differently from each other and, consequently, may also approach the 
investigative process differently. For example, accident investigation and safety 
data analysis are separate units at Boeing, while at other manufacturers, they are 
combined and often linked to customer support in a single organization. 

The closest thing to a constant among manufacturers’ safety departments is 
their responsibility for accident investigation. When a company’s product is 
involved in an accident, the company has a duty to help find the causes. In the 
parlance of the NTSB, the company becomes a party to the investigation, as 
discussed in Chapter 6. That means the manufacturer’s representatives work 
alongside NTSB investigators in examining evidence at the accident site. The 
parties conduct subsequent tests and suggest findings, but the final analysis and 
published report are produced by the NTSB. 

Safety departments with manufacturing companies scrutinize incidents as 
well as accidents. Committees are formed to represent various departments using 
new safety management systems (SMS) procedures. Doing so is part of the 
overall evolution from reactive safety to proactive safety, as discussed in 
Chapter 7, and as part of the SMS framework presented in Chapter 12. 

Based on the events reviewed, the committees recommend design changes or 
revisions in maintenance or operating procedures. Accident reports produce a lot 
of data, but the lack of frequency of accidents compared to the frequency of 
incidents means that still more data come from incident reports and other report 
files compiled by airlines, manufacturers, and government agencies. The FAA, 
for example, records Service Difficulty Reports. Manufacturers’ safety 
departments have come to view these reports as a resource to be developed and 
cultivated. The data come from a variety of sources. Manufacturers’ service 
representatives around the world report regularly on anomalous events both large 
and small. 


Airlines often report issues directly to manufacturers for both prompt, 
remedial action input and overall tracking of discrepancies for any given part or 
system. Other data sources include civil authorities and international 
organizations such as the International Air Transport Association, the U.K. 
CAA, and U.S. FAA, as well as insurance underwriters and publications. Even 
with all those collection efforts, safety staff do not claim that a record of every 
event unfailingly finds its way to the appropriate database. When little or no 
damage is involved, airlines sometimes make no external reports due to the very 
high tempo of technical operations and the never ending list of repairs and 
inspections that demand constant attention. 

While manufacturers of large airframes maintain what probably are the most 
extensive databases, other manufacturers also are collecting such information. 
Makers of engines and other components are also in the business of collecting 
statistical data. The purpose of gathering the data is trend analysis. Computers 
may be able to discern patterns that a human analyst may miss. Boeing has taken 
a proactive stance in the area of safety. Manufacturers can alert carriers to 
problems they did not know they had. A team assembled by Boeing uses 
accident records and other data to identify current safety issues. For example, 
Boeing was a leading proponent in stressing the importance of installing ground 
proximity warning system (GPWS) and the need for proper training in its use. 

Similarly, to prevent approach and landing accidents, Boeing has urged that 
every runway used by commercial transports be equipped with an instrument 
landing system (ILS) and several training measures have been advocated for 
pilots and controllers to alleviate the dangers associated with nonstabilized 
approaches. 

Boeing research also has addressed crew-caused accidents. Its data and other 
sources identify flight crew error as the primary cause in close to 70% of 
commercial jet hull-loss accidents (see the next section “Boeing’s Accident 
Statistical Summary”). However, accidents rarely have a single cause. 
Manufacturers’ prevention strategies address all the factors, not just the primary 
one. Removing even one link in the chain of events can prevent many accidents. 

Airlines maintain databases and conduct trend analyses of their own. These 
analyses can benefit from work done by the manufacturers. For example, 
American Airlines studied a series of Boeing 757 tail strikes. After assessing its 
own records, the carrier checked with Boeing about the experiences of other 
operators of the same type of aircraft. Once the problem was identified, 
American Airlines and Boeing worked to solve it by revising training methods. 

The large airframe manufacturers also publish annual reports that are 
camnilations of industrv-wide accident data. Tt should also he noted that. for 
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day-to-day problem- solving, airlines usually have more contact with a 
manufacturer’s accident and incident investigators than with the analysts behind 
the data. In the discussions that follow, databases from Boeing, the Flight Safety 
Foundation, and the NTSB will be explored to analyze aviation accident 
statistics. 


BOEING’S ACCIDENT STATISTICAL SUMMARY 


According to the Boeing’s accident statistical summary, in the 50 years plus, 
worldwide history of scheduled commercial jet operations (1959 to 2015), there 
have been 1,918 accidents resulting in 29,646 onboard fatalities and 1,216 
external fatalities. Of the 1,918 accidents, 619 produced fatal and 973 resulted in 
hull losses. 

If one were to consider accidents by type of operation, 80% (1,525) of the 
1,918 accidents were passenger operations, 14% (269) were cargo operations, 
and the remaining 6% (124) occurred during testing, training, demonstration, or 
ferrying. U.S. and Canadian operations collectively incurred about 30% (571) of 
the 1,918 worldwide accidents, contributing to about 21% (6,202) of the 29,646 
global onboard fatalities. Over this period, there have been in excess of 713 
million cumulative departures and more than 1,321 million cumulative flight 
hours. The industry is now operating 24,611 jet aircraft, with little over 27 
million departures each year. 

If we examine a plot of all accidents for the worldwide commercial jet fleet 
for the period 1959 to 2015, as shown in Figure 11-1, we can see that the rates 
for all accidents and those involving hull losses appear fairly stable for the past 
AO years. Closer inspection, though, reveals a steady and continuous decrease 
until reaching an asymptotic state in the past two decades. However, even if this 
low accident rate remains constant over the next few years, we can expect to see 
an increase in the actual number of hull-loss accidents each year as the fleet 
increases in number of departures. 
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FIGURE 11-1 Accident rates and fatalities by year; all accidents, worldwide commercial jet fleet, 1959- 
2015. (Source: Boeing 2015 Statistical Summary, July 2016) 


Hull losses and fatal accidents were also analyzed according to the phase of 
flight in which they occurred (Figure 11-2). The combined final approach-and- 
landing phases accounted for 49% of the hull-loss and fatal accidents, followed 
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by the combined phases from loading through initial climb (23%). Cruise, which 


accounts for about 57% of flight time in a 1.5-hour flight, occasioned only 12% 
of hull-loss accidents. 
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Distribution of fatal accidents and onboard fatalities 
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FIGURE 11-2 Accidents and onboard fatalities by phase of flight; hull-loss and/or fatal accidents, 
worldwide commercial jet fleet, 1992-2015. (Source: Boeing 2015 Statistical Summary, July 2016) 


In past years and in the previous editions of this book, the summary also 
considered primary causal factors for commercial operation hull-loss accidents. 


Classifications occurred for primary causes as attributed to flight crew, airplane, 
weather, maintenance, airport/ATC, or miscellaneous/other. However, Boeing 
has recently stopped reporting this data in adherence with emergence 
philosophies described earlier in this book about the risks of such monocausal 
assignments. Finally, fatalities by accident categories were covered for the 
period 1960 to 2015 (Figure 11-3). Loss of control in flight accounted for 1,396 
onboard fatalities, followed by runway excursions, which had 632 onboard 
fatalities and 35 external fatalities during the recent 15-year period. 
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FIGURE 11-3 Fatalities by accident categories, fatal accidents, worldwide commercial jet fleet, 2000- 
2015. (Source: Boeing 2015 Statistical Summary, July 2016) 


The three figures (Figures 11-1, 11-2, and 11-3) can be used as a launching 
platform for countless discussions about accident measurement, accident causes, 
and accident outcomes in terms of severity. For example, Figure 11-1 prompts 
thoughts about how different initiatives over the past century of flight have been 
used as links in the commercial aviation safety value chain. This includes the 
advent of jet engines with high mechanical reliability, the use of flight 
simulators in pilot training, and different maintenance inspection techniques that 
catch incipient problems before they become catastrophic. 

Similarly, Figure 11-2 can elicit a spirited discussion about the role played by 
aircraft status in the severity of outcomes as a function of the phase of flight 
when an event occurs. An additional area for discussion is that of exposure to 
different internal and external threats to the operation of aircraft. 

Lastly, Figure 11-3 prompts the reader to ask whether the relative distribution 
of accident categories has remained fixed or has changed over time. The same 
discussion can be projected into the future by exploring how the relative 
distributions may change with increased reliance on automation in both flight 
deck operations and external safety systems such as those found in airfield 
operations and air traffic control. 

These three figures are representative of the whole report and of the even 
larger use of data and statistics for managing safety. As such, it is evident that 
their use helps prompt questions and analyses that shed light on different issues 
in safety and assist with evidence-based decision making by government 
officials, airline managers, and manufacturers. 

It should be noted that Boeing’s accident data exclude turboprop aircraft as 
well as those with maximum gross weights of 60,000 lb (27,216 kg) or less; 
Soviet Union and Commonwealth of Independent States accidents; and accidents 
resulting from sabotage, hijacking, suicide, and military action. Although it is 
not an exhaustive compilation of data, and therefore only offers a partial 
statistical analysis, the content still proves highly useful for determining safety 
initiatives. 

Based largely on data such as these, it has become increasingly apparent that 
the largest challenge facing airline safety management continues to be human 
error. This recognition is not new. In 1974, the Flight Safety Foundation held its 
28th Annual International Aviation Safety Seminar in Williamsburg, VA. The 
theme was human factors in flight operations, and it is believed that this seminar 
was the first major airline industry safety conference devoted to human error. In 
1975, International Air Transport Association (IATA) sponsored its 20th 
Technical Conference: Safety in Flight Operations. The conference proceedings 
were almost exclusivelv facused on human factors and hiuman-error issues. 
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which were termed “the last frontier of aviation safety.” These early industry 
efforts were at the vanguard of present-day approaches to the problem of 
management and control of human error in aviation operations. 

The University of Texas’ Human Factors Research Project conducted aviation 
safety research funded by the FAA and industry for over 25 years. More 
recently, a current safety initiative of the Flight Safety Foundation is a project 
entitled “Operators Guide to Human Factors in Aviation” and contains an 
extensive compendium of Human Factors information on their Web site 
(flightsafety.org). The Flight Safety Foundation, in conjunction with AIRBUS, 
established an annual Human Factors in Aviation Safety Award which is 
presented at the FSF European Aviation Safety Seminar. Likewise, IATA and 
ICAO are very active in Human Factors training on an international basis. The 
subject of Human Factors has been thoroughly explored earlier in Chapters 3 and 
4 of this textbook. 


UNITED STATES’ STATISTICS 


For the United States, the primary source of accident data is the NTSB. Because 
of the NTSB’s very broad definition of an accident, the United States 
experiences an average of close to 36 accidents involving scheduled and 
nonscheduled air service each year. However, serious accidents, those involving 
fatalities, are much rarer. The NTSB’s official compilation of accident statistics 
from 1995 to 2014 for Part 121 scheduled and nonscheduled airline service 
provides excellent insights into the state of modern commercial aviation safety 
in the United States. 

In that transportation segment, the country averages 20 to 50 accidents per 
year of which only 0 to 6 accidents are fatal accidents with 0 to 525 onboard 
fatalities per year. Such numbers do not mean much unless a rate can be derived 
by comparing them to flight time or departures as a measure of exposure. The 
NTSB also calculates that in a year period there are between 13 and 20 million 
flight hours and between 8 and 11 million departures. Therefore, the accident 
rate can be calculated as being between 0.17 and 0.3 accidents per 100,000 flight 
hours and between 0.06 and 0.036 fatal accidents per 100,000 flight hours. 

When using departures as the denominator to calculate the rates, the NTSB 
numbers show that between 0.248 and 0.52 accidents occurred for each 100,000 
departures and between 0.009 and 0.061 fatal accidents occurred per 100,000 
departures. The difference in numerators is because not all accidents involve 
fatalities. Although such numbers are still not acceptable to the traveling public 
and to those affected bv the tragedies renresented bv each fatal accident. the 
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overall picture for commercial aviation safety is quite positive. It should be 
noted that the September 2001 terrorist attacks are excluded from this analysis 
since they were intentional acts that fall under the domain of security, and 
therefore, are not safety-related. 

As a form of comparison to other transportation modes, the NTSB Web site 
also provided preliminary estimates of measurements for fatalities in 2013 
associated with highway (cars, trucks, motorcycles, etc.), marine (ships), and rail 
(trains) modes. The year 2013 was the most current year for such an inter-modal 
comparison. In aviation there were 443 fatalities that year, of which only 9 were 
associated with the airlines and 6 with commuter categories. The vast majority 
of aviation fatalities, 387, were associated with general aviation. By comparison 
there were 615 marine fatalities that same year and 891 rail fatalities. As one 
might expect, the number for highway fatalities is startlingly higher at 32,719 for 
that same year. Granted, the reader should be cautious when comparing between 
Statistics that are bereft of exposure data. 

For such a purpose we can reference the statistical analysis performed by the 
Airlines for America, which is an American trade association and lobbying 
group that represents the largest airlines and which is based in Washington, D.C. 
The analysis draws on other sources of data, such as those from the National 
Safety Council, the American Public Transit Association, the Federal Railroad 
Administration, and the NTSB. The analysis depicts the big picture by stating 
that overall about 2 out of every 10 unintentional injury-related deaths occur in 
passenger transportation. Unintentional deaths exclude suicide and homicide. 
However, the risk of passenger death, as expressed on a per 100 million 
passenger mile basis for travel from 2010 to 2012, is 0.49 for light duty vehicles 
(e.g., cars, SUVs, light trucks, and vans), 0.05 for buses, 0.02 for trains, and 0 
for airlines. In fact, from 2010 through 2015, there were zero fatal accidents for 
U.S. airlines. Thus, it can be said with confidence that commercial aviation is the 
safest mode of transportation in the United States. 


GLOBAL STATISTICS 


On an international scale, statistics are available from both governmental and 
private sources. On the government side, every year ICAO publishes a readily 
accessible and very detailed safety report that depicts accident statistics and 
concomitant analyses. The latest such report, published in 2016 and containing 
data through 2015, shows an ongoing, year-over-year improvement in both the 
number of accidents as well as the accident rate. The global accident rate 


involving scheduled commercial operations dropped by 7% from 3 to 2.8 
accidents per million departures from 2014 to 2015, and, indeed, the number of 
fatal accidents in 2015 was down to 6, representing the lowest number in the 
past 5 years. Also, the 474 fatalities in 2015 were a significant decrease from the 
904 fatalities in 2014. 

On the private side, IATA is a trade association for the world’s airlines, 
comprising 268 airlines from 117 countries. According to IATA, in 2015 there 
were 37.6 million flights and approximately 3.5 billion passengers. Despite the 
high volume of flights, only 68 commercial airline accidents occurred. Of these 
68 accidents, only 4 resulted in passenger fatalities. It is important to note here 
that Germanwings Flight 9525 and Metrojet Flight 9268 were not included in the 
data since they were classified as deliberate acts of unlawful interference. The 
2015 figure represents a decline from the 77 accidents in 2014. More good news 
is that during the 5-year period from 2010 to 2014, the average rate of accidents 
per year was 90. From this, we can see that the long-term trend indicates that 
flying is continuing to get safer. The IATA numbers represent a different way of 
measuring the same aspects of safety as those of ICAO. Both approaches show 
continued improvement and that commercial aviation is overall a very safe mode 
of transport. 


OCCUPATIONAL ACCIDENT STATISTICS— 
DEPARTMENTOF LABOR, BUREAU OF LABOR 
STATISTICS (BLS) 


Commercial aviation safety also requires protecting the very large portion of the 
workforce that falls outside of flight crews, such as the ramp agents, airfield 
managers, aviation maintenance technicians, dispatchers, and air traffic 
controllers, from harm. 

The death toll trend due to occupational injuries has been on the decline over 
the past decades because of new technology, stricter safety regulations, and a 
shift in the economy toward safer service-industry jobs. The Census of Fatal 
Occupational Injuries program reported that the number of fatal work injuries in 
the United States in 2014 was 4,821, slightly up from 4,585 in 2013. Even 
though there has been variability in this figure over the past 10 years, there is no 
significant trend to indicate if workplace fatalities are up or down for the 5-to 
10-year window that we like to use for analyzing and comparing aviation safety 
data. Overall though, the transportation industry still suffers from the most work- 
related fatalities than any other sector. 


The Bureau of Labor Statistics (BLS) still remains the authoritative source for 
nonfatal occupational (work-related) illnesses and injuries in the United States. 
The BLS, in cooperation with OSHA and the state government agencies in the 
United States, uses scientifically developed sampling surveys to collect data on 
nonfatal injuries and illnesses. All deaths are reported directly to OSHA. The 
surveys exclude the self-employed farms with fewer than 11 employees, private 
households, federal government agencies, and employees in state and local 
governments. The results are published in the Standard Industrial Classification 
(SIC) Manual, which was first developed and published in 1987. Information in 
the SIC Manual is published by industry type. Major groups are further divided 
into industry groups with each industry group having SIC codes within it. 


NORTH AMERICAN INDUSTRY CLASSIFICATION SYSTEM (NAICS) 


Developed in cooperation with Canada and Mexico, the North American 
Industry Classification System (NAICS) represents a profound change in 
government statistical reporting programs. NAICS uses a six-digit coding system 
to classify all economic activity into 20 service sectors. For example, the 
category of “Scheduled Air Transportation” is broken down into two codes as 
follows: 481111, “Scheduled Passenger Air Transportation,” and 481112, 
“Scheduled Freight Air Transportation.” The NAICS has been adopted to soon 
replace the Department of Labor’s SIC coding system, thus providing a new 
Statistical tool in the area of occupational accident statistics. 

The BLS Injuries, Illness, and Facilities program provides annual information 
on the rate and number of work-related injuries, illnesses, and fatal injuries, and 
how these statistics vary by incident, industry, geography, occupation, and other 
characteristics. 

In recent years, the number of work-related fatalities, injuries, and illnesses 
has steadily decreased in the Air Transportation subsector, NAICS category 481. 
For example, the number of fatalities in this subsector decreased from 38 in 2008 
to 28 in 2009, which represents a significant reduction. Similarly, the rate of 
injury and illness cases fell for the category of total recordable cases. This 
includes incidents that involve days away from work and days of job transfer or 
restriction. However, when compared with general industry injury and illness 
trends, the air transportation rates are 8.5 total recordable cases per 100 full-time 
workers, which is nearly twice the national injury average. While general 
industry injury and illness trends have been at their lowest level in years, the air 
transportation sector could still use some significant improvement. 

Like many collected data, the NAICS/BLS statistics have some limitations. 


As with most surveys, the data are subject to sampling error. There are also other 
sources of error, such as the inability to obtain information about all cases in the 
sample, mistakes in coding or recording data, and difficulties reaching 
agreement on certain definitions that define data to be used for analyses. 
Furthermore, since these statistics provide an estimate of workplace injuries and 
illnesses based on logs kept by employers during the year, the collection process 
is only as good as the employers’ understanding of which cases are work-related 
under OSHA’s recordkeeping guidelines. Finally, the number of injuries and 
illnesses that get reported can be influenced by the level of economic activity, 
working conditions, work practices, worker experience and training, and the 
number of hours worked. 


CONCLUSION 


In his autobiography, Mark Twain references the following quote: “there are 
three kinds of lies: lies, damned lies and statistics.” This saying goes on to show 
how people often use numbers to strengthen their arguments at the risk of 
misrepresenting meaning if not used carefully. In aviation, statistics are used to 
measure safety and to provide evidence to justify safety recommendations. The 
range of safety issues present in aviation includes minor sprains and injuries all 
the way to major catastrophic accidents. Therefore, we cannot rely solely on one 
calculation to accurately paint the picture of the safety landscape. Instead, we 
must put everything together, whether it is data from the NTSB, IATA, 
manufacturers, BLS, or OSHA, to get a holistic view of the safety scene. 

Although no single measure can indicate the overall status of safety in an 
organization, individual statistics by themselves are still helpful for determining 
smaller aspects of safety. They can assist us in identifying weak links in the 
commercial aviation safety value chain. Ultimately though, the goal is to 
continue to reduce the number of fatal accidents per year, and we can do this by 
crafting a variety of measures in response to properly collected and analyzed 
safety data. 


KEY TERMS 


Accident Rate 

Bureau of Labor Statistics (BLS) 
Crew-Caused Accidents 
Exposure Data 


Hull Loss 

Major, Serious, Injury, or Damage Accident 

North American Industry Classification System (NAICS) 
Probability 

Safety Factors 

Safety Indicator 

Service Difficulty Reports 

Standard Industrial Classification (SIC) Manual 


REVIEW QUESTIONS 


1. Why is the accident rate a better measure of safety than accident counts? 


2. Discuss some of the issues associated with analyzing and comparing 
commercial aviation accident statistics. 


3. Explain why aviation safety statistics are calculated differently than ones for 
other modes of transportation. 


4. Why is it important to open and sustain a dialogue about safety statistics 
among all players in the aviation industry? 


How does trend analysis contribute to analyzing safety? 

What are some lessons that can be learned from the Boeing summary? 
Explain how OSHA injury and illness rates are calculated. 

What are SIC and NAICS codes and how are they used? 


How do OSHA injury and illness rates relate to the safety of aviation’s 
operating environment? 
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LEARNING OBJECTIVES 


After completing this chapter, you should be able to 


e Discuss the evolution (history) of Safety Management Systems (SMS) 
principles. 


e Define and discuss the features of the Four Components (Pillars) of SMS. 
e Compare and contrast the differences between a hazard and a safety risk. 
e Discuss the significance of the Probability x Severity = Risk formula. 


e Explain the purpose of the risk assessment 5 x 5 Matrix in terms of 
probability and severity. 


e Discuss the significance of reducing risk to a level as low as reasonable 
practicable (ALARP). 


e Describe the role of unions in airline safety. 

e Describe the principle elements of the safety assurance process. 

e Discuss the role of auditing in the safety assurance process. 

e Discuss the role of accident investigation in commercial aviation SMS. 


e Explain the importance of communications to an effective airline safety 
program. 


e Discuss the international development aspects of SMS. 

e Explain the development of airline SMS in the United States. 
e Explain the phased SMS implementation process. 

e Discuss some of the challenges of SMS implementation. 


INTRODUCTION 


Safety Management Systems (SMS) is a term describing a standardized approach 
to controlling risk across an entire organization that promotes the sharing of 
safety data and best practices. SMS requires crafting policy, methodically 
calculating and controlling risk, measuring how everything is working, and 
communicating it all to employees. A commercial airline, like any other major 
business, has to integrate and manage a complex array of tasks to deliver 
products and services to the customer. Safety must be built into every aspect as 
an integral part of every employee’s job responsibility. After all, safety is a team 
effort. This book has repeatedly used the expression of a safety value chain to 


describe how every employee and technology are links in the chain, and chains 
are only as strong as the weakest link. The airline industry has always placed 
great emphasis on safety and has moved aggressively to identify and control 
problems that cause accidents. Airlines have learned, sometimes the hard way, 
that active management of risk is an absolute requirement for a healthy 
company. 

Even though the management of safety is not a new concept, it was not until 
the 1990s that safety professionals started seriously asking the rather profound 
question of whether they were managing safety at peak efficiency. This 
introspective question may have been prompted by recognition of the safety 
professional’s role in an organization, by increased public awareness that 
advances in scientific and business principles can be applied to management for 
making any operation more efficient, and that safety is a state that requires 
management. 

It was probably the convergence of those lines of thinking, combined with the 
traveling public’s increasing intolerance of inefficiency, which led to the birth of 
a standardized approach to minimizing risk, which today we call Safety 
Management Systems (SMS). Although safety management as a practice has 
existed since the birth of aviation, in one way or another, SMS is a formal and 
standardized framework of best practices for running a safety program based 
around sophisticated business and scientific processes. Those processes are not 
just used to create safety, but also used to monitor the health and effectiveness of 
a safety program so that it operates at peak performance. A key component of 
the architecture mirrors the business world’s use of performance indicators. In 
SMS, these are called safety performance indicators. 

An ideal airline SMS would have unlimited resources to manage the safety 
demands of the business. If that were the case, the management of safety would 
not be that difficult. However, since commercial aviation is in the business of 
making profit and any investment in safety requires people, time, and money, 
limited resources force airlines to choose wisely about how to allocate their 
funds. Safety efficiency, therefore, is not just about making risk management 
more streamlined and effective, but also about saving money by operating a 
safety program as lean as possible without seeing significant safety issues arise. 

Safety and efficiency of airline services should never be in competition, 
rather they should be in balance during management’s decision-making process. 
Although safety is a major function and should permeate through all 
departments, it is not the main objective of the commercial airline industry. 
Ultimately, an airline’s primary goal, as with any business, is profit. Airlines sell 
a promise to get passengers from one destination to the next. Although safetv 


contributes to fulfilling this promise, so do monetary factors such as punctuality, 
cost-effectiveness, and predictability. The dichotomy between safety and profit 
can be perceived as being in conflict because safety can be very expensive. The 
champions of safety see their expenditures as investments to prevent future 
catastrophes and often say, “Safety may be expensive, but not nearly as 
expensive as the lack of safety.” A company’s managers may sometimes be 
tempted to put production ahead of protection, and profit at the expense of 
safety, with occasional disastrous consequences. Therefore, many safety 
managers are sophisticated enough to avoid the logical error of referring to 
“safety as the top priority,” but instead refer to the need for safety as an enduring 
job requirement that accompanies all priorities. 

An organization’s corporate culture must emphasize safety jointly with profit, 
controlling risk as a core value to help the bottom line, not to hinder profit. The 
best approach is a balanced allocation of resources where safety management is 
a core business function, closely intertwined with business objectives and not in 
competition with the profit aspects of the business. As shown in Figure 12-1, 
safety and profit should be perceived as inseparable, since an unsafe commercial 
operation will soon cease to be used by customers. Curiously, the picture depicts 
passengers with seatbelts unfastened, which further highlights the need for a 
company to enforce passenger safety requirements. This is one example of how 
enforcement of safety standards is vital to prevent personal injury. 


FIGURE 12-1 The ultimate objective of SMS is maximizing safety efficiently. (Source: FAA) 


In many chapters of this book, the reader has already been introduced to 
aviation SMS concepts. This chapter will bring together many of the previously 
discussed ideas as we formally introduce and explain the framework of SMS. 
We will discuss the history of SMS principles, the fundamental concepts, the 
tools and techniques used by aviation safety professionals, and the future of 
SMS in commercial aviation safety. 


EVOLUTION OF SMS 


It is clear that modern safety principles have significantly evolved in the years 
following World War II. Following the war, commercial aviation saw significant 
growth and so did the enabling technology with the introduction of the B-47, the 
jet engine, and swept back wing configuration. This technical era of aviation 
safety concentrated on the improvement of technical factors during the decades 
of the 1950s and 1960s. 


In the 1970s, the Japanese gained world market share in the electronics and 
automobile industry using the “Total Quality Management” (TQM) concepts of 
quality experts, W. Edwards Deming and Joseph Juran, among others. This 
movement in Japan focused on improving the quality of manufactured products 
through teamwork and employee involvement. In the aviation world, the focus 
shifted to the human era by using such tools as Crew Resource Management 
(CRM) and Line-Oriented Flight Training (LOFT). As outlined by ICAO in the 
Safety Management Manual, the mid-1970s to the mid-1990s has been called the 
golden era of aviation human factors. 

In the early 1990s, aviation safety thinking shifted its focus to the 
organizational era, where safety was viewed from a system perspective which 
included technical, human, and organizational factors. As previously discussed, 
Dr. James Reason’s so-called Swiss Cheese Model introduced the concept of the 
“organizational accident,” which is a breakdown of organizational processes 
resulting in an accident. Using quality-based employee involvement and cultural 
empowerment concepts employed by the Japanese and adopted by the 
International Organization for Standardization (ISO), aviation SMS theory has 
evolved into a worldwide movement which pays great safety dividends. It should 
not surprise the reader that SMS is closely tied to business efficiency concepts. 
After all, an accident is the ultimate expression of an inefficient process. Figure 
12-2 illustrates the evolution of safety thinking from the technical era, into the 
human era, and now including the recent organizational era focus. 


Evolution of Safety Thinking—actors in Accidents 
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FIGURE 12-2 The roots of SMS can be traced to three overarching concepts. (Source: FAA) 


As previously discussed in Chapter 5, ICAO is the United Nations 


organization that issues international standards related to worldwide aviation. 
Since its foundation in 1944 at the Chicago Convention, ICAO has been in the 
forefront of airline safety matters, and its member States (191 countries) have 
agreed to abide by the ICAO annexes known as Standards and Recommended 
Practices (SARPs). 

Annex 6 to the Chicago Convention deals with International Commercial Air 
Transport. Amendment 33 of Annex 6 sets the stage for international awareness 
and implementation of SMS by the world’s airlines. It provides that ICAO 
member States shall require its operators to implement an SMS that as a 
minimum: 


e Identifies safety hazards. 


e Ensures that remedial action necessary to maintain an acceptable level of 
safety is implemented. 


e Provides for continuous monitoring and regular assessment of the safety level 
achieved. 

e Aims to make continuous improvement to the overall level of safety in the 
United States. 


Safety Management System concepts began to influence government safety 
profoundly about 10 years ago in the United States. Early discussions made it 
clear that SMS would have to be adopted by both the regulator as well as the 
regulated and that there needed to be transparency for programs to succeed. This 
included a collaborative effort between the airline industry and the FAA to share 
data, analyze risk, and develop a plan of action for moving forward. Stolzer and 
Goglia (2015) tracked the timeline for SMS implementation in the United States. 
It was not until 2006 that ICAO established an amendment to Annex 6 which 
made it a requirement for ICAO members to develop and implement an SMS. At 
this time, the FAA began gearing up for the new requirement by developing an 
aviation rulemaking committee, piloting voluntary pilot projects, and creating 
informational material. The efforts targeted air carriers, repair stations, design 
and manufacturing firms, and airports. The objectives of the FAA’s SMS pilot 
projects were threefold: 


1. Develop SMS implementation strategies 
2. Develop FAA oversight interfaces 
3. Gain SMS experience for FAA and service providers 
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Major U.». airlines started participating 1n these voluntary programs, as SIMS 
implementation was also underway in the international airline community. 

The crash of Colgan Air Flight 3407 near Buffalo, New York, on February 
12, 2009 had a profound effect on commercial airline safety. By FAA Order 
1110.152, the FAA established the SMS Aviation Rulemaking Committee 
(ARC), which was chartered to provide recommendations to the FAA on the 
development and implementation of SMS regulations and guidance. 

Essentially, the SMS ARC recommended a detailed blueprint following 
ICAO international guidelines. The ARC recommended FAA SMS regulations 
and guidance be closely aligned and consistent with the same ICAO SMS 
framework of the 4 components and 12 elements discussed throughout this 
chapter. 

In the wake of the Colgan crash, the U.S. Congress passed Public Law 111- 
216 which originally required a final FAA SMS airline rule by August 1, 2012. 
This requirement for all Part 121 air carriers in the United States was the first 
time that the FAA mandated the implementation of an SMS program. The final 
U.S. version of SMS is based upon the ICAO system and exhibits fundamental 
characteristics as recommended by the ARC. The features of the final rule 
regarding FAR Part 121 SMS include the following: 


e Alignment with ICAO SMS framework and international acceptability. 


e Phrased promulgation of regulations and implementation of SMS 
requirements by FAA. 

e Scalability and flexibility of the regulations to accommodate a broad range of 
organizations. 

e SMS processes should not change existing regulatory standards for FAR Part 
121. 

e Consistent with Public Law 111-216, the FAA recognition and 
implementation of existing voluntary safety systems as part of the airline’s 
SMS such as the following: 

e Aviation Safety Action Program (ASAP) 

e Flight Operational Quality Assurance (FOQA) Program 
e Line Operations Safety Audit (LOSA) 

e Advanced Qualification Program (AQP) 


In January 2015, a revised SMS Advisory Circular (120-92B) was published 
by the FAA which contains important information pertaining to all aviation 
sectors. The final airline SMS rule (14 CFR Part 5) requires airline operators 


authorized to conduct operations under Part 121 to develop and implement an 
SMS within 3 years. By March 9, 2018, all U.S. Part 121 air carriers must have 
an SMS that meets 14 CFR Part 5 requirements. The corresponding SMS rule for 
Airports is in its final stages and should be released in the near future. 


ICAO ANNEX 19: CONSOLIDATION OF SMS STANDARDS 


In view of the increasing complexity and tighter interdependence among various 
aviation sectors, ICAO decided to consolidate all SMS standards into a new 
annex which allows a higher degree of integration of safety management 
functions. 

Annex 19 is the first, new ICAO Annex in over 30 years and was developed 
in two phases. The first phase involved the organizing of existing safety 
management-related content, modifications to improve the language for clarity, 
and modifications to ensure standardization and harmonization of SMS 
information across the ICAO Annexes. It was adopted by the ICAO Council on 
February 25, 2013 and became applicable in November 2013. Recently a second 
phase resulted in Amendment 1 to Annex 19. It raises the components of SMS to 
the “Standard” level and also addresses the protection of safety data and 
information. This newly adopted Amendment to Annex 19 was effective in July 
2016 and will become fully applicable in November 2019. 


STRUCTURE OF SMS: FOUR COMPONENTS (Pillars of SMS) 


In order to simplify and organize the best practices of managing safety, the 
Federal Aviation Administration (FAA) in the United States chose to formulate 
four large-scale components under which to organize concepts. Other countries 
follow a similar structure although some aviation organizations have different 
organizing plans. Regardless of SMS structures, the philosophies that guide the 
systems are all similar. SMS is as an organized approach to controlling risk from 
unintentional damage or harm, including the necessary organizational structures, 
accountabilities, policies, and procedures. 

In the United States the SMS framework consists of 4 components (also 
known as pillars), and 12 elements within those components. The FAA provides 
guidance on these components as they are keys to implementing SMS. The four 
components of SMS are as follows: 


1. Safety policy. Establishes senior management’s commitment to improve 


safety continually; defines the methods, processes, and organizational 
structure needed to meet safety goals. This can be remembered via the 
expression document it in writing, referring to the need to have key aspects 
of a given SMS readily available to employees as a written reference. 


2. Safety Risk Management (SRM). Determines the need for, and adequacy of, 
new or revised risk controls based on the assessment of acceptable risk. 
This can be remembered via the expression hunt the hazards, then assess 
and mitigate the risks, referring to the fundamental need of having 
employees aggressively seek safety problems and having a means of 
effecting change to produce better conditions. 


3. Safety Assurance (SA). Evaluates the continued effectiveness of 
implemented risk control strategies, and supports the identification of new 
hazards. This can be remembered via the expression measure and improve 
it, referring to the need to use scientific principles to determine the 
effectiveness of the actual management change processes being used. 


4. Safety Promotion. Includes training, communication, and other actions to 
create a positive safety culture within all levels of the workforce. This can 
be remembered via the expression learn it and share it, referring to the need 
to continuously learn about the SMS, about new and old hazards, and 
disseminating such life-saving information to all employees who can affect 
safety. 


The FAA’s approach to organizing SMS by placing concepts into four 
components is illustrated in Figure 12-3. Note how the promotion component is 
shown to impact all three other components. 
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FIGURE 12-3 The organizing scheme for SMS. (Source: FAA) 


COMPONENT #1: SAFETY POLICY 


Safety policy encompasses the leadership of the Accountable Executive to 
provide clear safety objectives, methods, processes, and the organizational 
structure needed to meet safety goals. Safety promotion refers to the 
nonpunitive, positive safety culture (also known as a “Just Culture”) which 
empowers all employees to have a role in safety. This is accomplished through 
comprehensive SMS training, communication, and awareness techniques. 

It is appropriate that this element is placed first on the list since it sets the 
stage for the other elements to exist and reach full potential. The starting point 
for SMS Policy is identifying the “Accountable Executive” (AE), who is a 
single, identifiable person having final responsibility for the organization’s SMS, 
including decisions regarding operations and everything that supports 
operations. The FAA has produced several flowcharts to help organizations 
determine who fills this important position. For purposes of this chapter, the 
reader can assume that the AE of a large airline will be the Chief Executive 
Officer (CEO), and of a small commercial aviation operation, the AE may be the 
owner. 


That AE must then oversee how his or her “organization defines safety policy 
in accordance with international and national requirements and will sign the 
overall policy. It should reflect the organization’s commitment to safety, should 
include a clear statement about the provision of the necessary resources for the 
implementation of the safety policy, and should be communicated throughout 
the organization.” Identifying precisely who that AE is becomes critical because 
senior management is in control of the safe and efficient operations of the 
aviation organization. It is through management that employees are hired, 
trained, and dismissed when necessary. The safety policy should be developed 
by senior management and clearly communicated to all employees. It is 
extremely important that leadership be strong, demonstrable, and visible if the 
airline’s SMS program is to succeed. 

Safety policy should also make clear that safety is the responsibility of all 
members of management, not just the safety department. The policy should 
clearly lay out who the safety manager is and how the company’s SMS shall be 
administered so that responsibility is widely distributed for safety. This will 
often take shape by using a Safety Action Group (SAG) and Safety Review Board 
(SRB) to assist management officials in accomplishing safety responsibilities. 
Under normal circumstances, the safety manager communicates to the AE 
through either the SAG or the SRB. The SRB is a very high level strategic 
direction group chaired by the AE, which includes senior line functional 
managers. Once strategic direction has been developed by the SRB, the members 
of the SAG are tasked with implementing the decisions at a tactical level. In this 
typical SMS organization, the Safety Manager serves as the secretary of the 
SAG to record its actions and keep score of corrective actions taken. 

Safety policy should also ensure that an Emergency Response Plan (ERP) 
allows for a smooth transition from normal everyday processes to emergency 
operations and then back to normal conditions once the emergency has been 
managed. Airlines prepare an ERP document in writing to describe what actions 
should be taken following an accident and who is responsible for taking each 
action. An annual emergency response drill is usually required to ensure that the 
plan is adequate and that designated personnel are appropriately trained. 

Lastly, careful documentation is an essential element of an SMS organization. 
Each AE should ensure that the safety manager has an SMS implementation plan 
that provides objectives, processes, and procedures and communicates who is 
accountable for what aspect of the plan. There also should be a manual that 
explains the whole SMS so that any employee can understand the operation. 
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The heart of any SMS organization is the interrelationship between safety risk 
management and safety assurance. Basically, the safety risk management 
process provides for the identification of hazards and assessment of risk. Once it 
is assessed, risk should be controlled (mitigated) to a level as low as reasonably 
practicable (ALARP). At this point, the safety assurance process takes over to 
assure that the risk controls are effective using system safety and quality 
management concepts of monitoring and measurement. 

Before a risk can be managed, a potential hazardous condition must be 
identified. It is easy to confuse the concepts of hazard or risk. A hazard is “a 
condition or activity with the potential to cause death, injuries to personnel, 
damage to equipment or structures, loss of material, harm to the environment or 
reduction of the ability to perform a prescribed function” (Source: ICAO Safety 
Management Manual, 3rd ed., Section 2.13.2). An example of a hazard is a leak 
in the hydraulic line of an aircraft braking system, but because it is not a risk in 
and of itself, the leak does not let us know how it impacts safety. 

A risk is the assessment, expressed in terms of predicted probability and 
severity, of the consequences of a hazard taking as reference the worst credible 
effect. Thus, risk can be expressed in a formula as: R = P xS, where 


e Ris the expected risk (loss) per unit of time or activity 

e P is the probability that a given hazard may materialize (likelihood of a loss 
event per unit of time or activity) 

e Sis the severity of consequences (effects) that the materialized hazard can 
generate (loss per event) 


So, returning to the previous example: 


e A leak in the hydraulic line of an aircraft braking system is a hazard. 


e The potential for running off the runway because the pilot might not be able 
to stop the aircraft on landing using brakes is one of the consequences of the 
hazard; however, 


e The assessment of the consequences of literally running off the runway 
expressed in terms of probability (P) and severity (S) is the safety risk (R). 


Stated another way for clarification, in the equation R = P x S: 


e P is the probability that the aircraft would run off the runway given that its 


stopping capability is impaired. 

e Sis the severity of the above event which could vary from no aircraft 
damage or injuries (near miss) to total destruction, or both (depending on 
variables such as the aircraft speed and runway remaining when the 
braking fault is noticed, availability of other means of stopping, etc.). 


Now that you can differentiate between a hazard and risk, it will make 
understanding the importance of the elements in the second component, safety 
risk management, easier. Analyzing a large volume of safety data from flight 
operations and determining risks are only one part of the equation. The 
information we gather is an integral component in creating, implementing, and 
validating the effectiveness of risk mitigation in an SMS. For this reason, the 
second component of SMS incorporates both hazard identification and risk 
assessment mitigation. 

Safety risk management begins with a clear understanding of an 
organization’s functional systems, which are analyzed by experienced 
operational and technical personnel to detect the presence of hazards. Under 
SMS, each organization should create and maintain a formal process that ensures 
that operational hazards are identified. Such a process should be based on a 
combination of reactive, proactive, and predictive methods of safety data 
collection. How hazards are identified will depend on the resources, culture, and 
complexity of the organization. 

After the safety hazards have been identified, they must be analyzed to 
determine their consequences to the organization. This step entails creating and 
maintaining a formal process that ensures analysis, assessment, and control of 
the safety risks in operations. The conventional method to analyze risk is to 
break it into two components, the probability of occurrence and the severity of 
the event should it occur, as previously described. Typically, one tool often used 
is called a “risk tolerability matrix,” which visually displays a risk to determine 
if it is unacceptable or needs further mitigation to reach the ALARP or 
acceptable region. ICAO illustrates this risk tolerability as an inverted triangle as 
shown in Figure 12-4. Note the coding of the risk matrix: 


The risk is 
unacceptable 
at any level. 


The risk is 
acceptable based 
on mitigation. 
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is required. 


The risk is 
acceptable as it 
currently stands. 


FIGURE 12-4 Safety risk management—tolerability matrix. (Source: ICAO Safety Management Manual, 
3rd ed., Section 2.14.11) 


Dark gray—unacceptable risk (intolerable) 
White—acceptable with mitigation (tolerable) 
Light gray—acceptable region 


To conduct a safety risk assessment, it is very helpful to plot it visually to 
clearly see the relationship between severity of consequences and likelihood of 
occurrence. The classic ICAO/FAA example of using a chart is provided in 
Figure 12-5. 


Risk Severity 
Risk 


Likelihood 


FIGURE 12-5 Sample severity and likelihood criteria. (Source: FAA Advisory Circular 120-92B) 


Safety Management System processes that use such a risk matrix require the 
development of criteria that explain each classification of severity and likelihood 
appropriate for the organization’s type of operations and their operational 
scenarios. For example, one organization operating smaller and less complex 
equipment may depict severity in terms of the dollar value of potential damage 
that is quite different from another organization utilizing very expensive 
equipment. Such risk assessments are often a combination of professional 
experience and expert judgment, including input from data collection tools. 

The purpose of risk mitigation is to control hazards by either eliminating 
them altogether or by reducing the severity or likelihood of the hazard to an 
acceptable level. We must look for the “weak signals,” which are early 
indicators of problems that many may not perceive as a danger. The order of 
precedence (hierarchy) for these controls is well established, and they are listed 
below in rank order from most effective to least effective (Stolzer & Goglia, 
2015, p. 171): 


1. Elimination of the hazard. The most effective is the engineering control 
strategy which eliminates the safety risk completely. An example would be 
providing interlocks to prevent thrust reverser activation in flight. Since this 
is a firm control solution, it is sometimes known as a “hard” control 


Strategy. 


2. Reduction of the hazard level. Reduction of the probability or severity of the 
event reduces its overall impact, perhaps moving its classification from 
unacceptable to acceptable on the risk assessment matrix. For example, the 
probability of a ramp agent being hit by a baggage cart tug can be reduced 
by requiring ramp personnel to wear reflective vests and the severity of 
being hit by a tug can be reduced by limiting the driving speed of tugs. 


3. Employment of safety devices. This control method is mechanical in nature 
(safety guards, rails, etc.) and often prevents exposure to potential hazards. 


4. Warnings and alert methods. These could be visual (warning light) or 
audible, such as an aircraft stall or landing gear warning horn. A weakness 
of such methods is that the warnings and alerts in and of themselves do not 
prevent damage or injury unless humans respond correctly. 


5. Safety procedures. These are known as administrative control strategies, 
and thus are considered a “soft” control measure. Training and regulations 
can be put into place, but human error can negate this type of control. 


Control strategies, techniques, and protective equipment impact the risk 
equation (R = P x S) in the following ways: 


e Design and engineering will aim to reduce/eliminate the hazard and works on 
the probability (P) side of the risk equation, which subsequently 
reduces/eliminates the severity (S). 


e Safety devices, which can be active or passive, reduce risk in a similar way to 
design and engineering but are considered less effective. They can be used to 
reduce severity and/or probability. Active safety devices require human action 
and are not as effective as passive devices. Examples include seating heights 
and windshields that provide increased visibility for pilots or collision 
avoidance systems. Passive devices require no human action to activate. They 
do not perform active monitoring but are always present. Examples include 
guardrails and safety nets. 


e Warning devices increase awareness of the hazards, and hence, reduce the 
probability of being impacted by hazards. Should the warning be ignored, the 
full extent of severity will be felt. 

e Procedures and training are mainly intended to reduce probability (P) but can 
also reduce severity(ies) as in emergency evacuation drills. 

e Personal protective equipment (PPE) serves to reduce the severity (S) from a 


materialized hazard. PPE should be considered the last line of defense, as it 
requires human input to be worn correctly, and even if worn correctly, it can 
be uncomfortable and cumbersome to wear. 


To wrap up some of the most important concepts about safety risk 
management, let us use the example of a voluntary reporting system for aviation 
maintenance technicians performing routine maintenance to an Airbus A320. An 
employee reported that the shift change process does not ensure that a work task 
has proper continuity between technicians. A proper SMS will institutionalize a 
routine method for assessing the risk associated with such a hazard, would 
implement controls for the risk, and then would provide a means to measure the 
control in the future to assess adequacy. 


INCIDENT AND ACCIDENT INVESTIGATION 


Some progressive companies investigate all unintended events, irrespective of 
whether these events led to injuries, illnesses, property damage, or equipment 
damage. This is done so that hazards are detected before they cause a significant 
impact on safety. Unfortunately there are still situations when safety is impacted, 
sometimes severely. This impact can range from incidents to accidents. An 
important component of the safety effort at any organization is an incident and 
accident investigation system. By investigating accidents, organizations learn 
how to prevent future accidents. Most companies, however, require some criteria 
to be met before an investigation is triggered. Investigations are initiated, for 
example, if accidents 


e Require reporting on the OSHA 300 log 
e Generate workers’ compensation claims 
e Cause personal injuries or lost workdays 
e Meet NTSB definitions of accidents/incidents 


e Result in an environmental spill 
e Cause property and/or equipment damage over a certain dollar value 


Once an investigation is triggered, the processes used, whether they are 
FAA/NTSB, OSHA, or EPA related, are very similar. A formal notification 
system should be in place to provide timely notice of such events to the safety 
department. A typical investigation process is now described. 

Once the safety department is informed of an event, an immediate 
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an investigation. When an investigation begins, depending on the circumstances, 
one or more individuals may be assigned to conduct the investigation, especially 
when it is clear that there may be more than one operating department involved, 
such as for incidents occurring during pushback where a flight crew, ramp 
agents, and perhaps ramp tower personnel may all be involved. 

The manner in which the investigation is conducted is a function of the type 
of event and the circumstances under which it occurred. Typically, all key 
personnel involved in an incident or accident are asked to submit written 
statements describing the facts and circumstances as they saw them. In addition, 
provisions are made immediately for conducting interviews with the key 
individuals involved in the incident or accident. These interviews can be done in 
person or over the telephone, depending on the specific circumstances. In person 
interviews are preferred. Similarly, interviews can be done individually or with a 
part or all of an entire crew. The people being interviewed are told that the 
purpose of the interview is safety only, that the information will not be used for 
any disciplinary or other purpose. Accounts will remain confidential to the 
extent permitted by law. Information learned from these interviews, along with 
written statements, forms an important element of these safety investigations. 

In addition to the interviews and personnel statements, other records and 
documents may be obtained and reviewed. Such material might include training 
records, training manuals and syllabi, aircraft and procedures manuals, 
information bulletins, and similar material. Another important source of 
information is the aircraft flight data recorder, which is read out as part of the 
investigation of many inflight events. Other relevant information is identified 
and obtained as necessary, including accident reports, technical reports, and any 
other documentation that may contain information relevant to the incident or that 
can provide useful information for formulating recommended practices and 
corrective actions. 

Following the collection of basic information, the investigator assembles and 
issues an accident report. These are brief, synoptic reports that describe the basic 
facts and circumstances of the event under investigation, including a history of 
the event, a summary of damage and injuries, an analysis, a list of findings, and, 
most importantly, recommendations for corrective or future preventive action. 
Also included is a brief summary of safety actions taken—operating departments 
are not required to wait for a formal recommendation from the safety department 
prior to initiating corrective or preventive action. 

Findings from safety investigations are derived from the facts and 
circumstances associated with the event and are based on the investigator’s 


— an 


analysis. here is no ettort to determine a cause or probable cause of an event. 
Findings are essentially a list of objective factors related to the event under 
investigation. 

The recommendation process is probably the most important part of this 
safety investigation program, and it is important to understand how it is handled. 

The accident investigation process described applies to investigations of 
minor accidents. In the case of a major accident (hull loss, occupational death, or 
a major environmental spill), coordination will be required with external 
agencies (NTSB, FAA, OSHA, EPA). (See Chapter 6.) For example, in the event 
of an aircraft crash, it is important that an airline has a detailed ERP that 
contains, among other things, detailed plans for an airline go-team who will 
participate in the accident investigation. The go-team should be headed by a 
senior manager, who serves as the primary coordinator for all company activities 
related to an accident investigation. Appropriate technical personnel are 
designated as potential members of a go-team, the actual makeup of which is 
determined on the basis of known facts at the time of notification, most 
importantly, aircraft type and location. With regard to the latter, for any accident 
occurring outside of U.S. airspace, the company go-team reports to the U.S. 
accredited representative, in full accordance with ICAO Annex 13. 

To support the go-team, all necessary equipment and supplies, such as PPE, 
communications gear, and other material that may be necessary to conduct a 
major accident investigation, must be ready for instant shipment to the scene of 
an accident. All members of the go-team should be formally trained in accident 
investigation and must have the OSHA-required blood-borne pathogen training. 
The go-team roster should also identify other personnel who are tasked with 
providing administrative support to its technical members. 

The ERP specifies the staffing of a command post by designated personnel 
from the affected airline. These people are responsible for the coordination of all 
activities related to the accident investigation, including the assembly of records, 
manuals, bulletins, and other necessary materials. Oversight and leadership of 
the entire effort should be under the direction of senior management, including 
the corporate safety officer. An annual emergency response drill is required to 
ensure that the plan is adequate and that the designated personnel are 
appropriately trained. 

Although absolutely necessary, an ERP and associated elements of the safety 
function are quite obviously something that no airline wants to activate for real. 
To meet this challenge, every airline company must have some form of 
independent, proactive accident prevention effort. The best means to accomplish 
this is to seek to identify hazards and risks consistently and then to eliminate 


these risks through accident prevention measures using SMS concepts. 

On a final note, virtually all operational incidents will require a certain level 
of technical investigation and analysis to fully understand and identify the 
underlying cause factors. Within the airline corporate structure, investigative 
responsibility for flight safety incidents must be clearly assigned. Similarly, 
professional investigative methods must be consistently employed in the 
technical area. Use of investigative tools such as the digital flight data recorder 
(DFDR) requires a consistent objective and confidential method of analysis, 
often under the supervision of the NTSB if the Board assumes jurisdiction of the 
accident or incident. Also, since analysis methods require complex transcription 
methods, it is likely that DFDR analysis will occur at the maintenance or 
engineering department. DFDR contents must always be maintained in a strict 
confidential status with operational DFDR analysis performed by personnel 
familiar with current operational procedures. 


ROLE OF UNIONS 


Quite a few airline pilot unions exist, such as the Southwest Airlines Pilots’ 
Association (SWAPA), with more than 8,000 members, or the Allied Pilots 
Association affiliated with American Airlines, which has around 15,000 
members. The largest is the International Federation of Air Line Pilots 
(IFALPA), which is a labor union founded in 1948, headquartered in Montreal, 
Canada, and accounts for over 100,000 members in over 100 countries. Air 
safety is a primary responsibility of every airline pilot. As the oldest and largest 
airline pilots’ union, the main role of IFALPA’s air safety structure is to provide 
channels of communication for line pilots to report air safety problems. The U.S. 
component of IFALPA is the Air Line Pilots Association (ALPA). 

An additional role is to stimulate safety awareness among individual pilots to 
enable flight crewmembers to be constructive critics of the airspace system. 
Finally, the air safety structure helps investigate airline accidents. Over the 
years, ALPA’s air safety structure has contributed significantly to air safety. 
Airline pilot unions have trained safety volunteers and led industry projects on 
aircraft wiring safety, human performance, and nonpunitive corporate cultures, 
among many other hot topics. 

Focusing on ALPA as an example, the basic unit of the union is the local 
council—the pilots of a single airline at a particular operating base. Each local 
council normally has an air safety committee, which processes local air safety 
problems and is headed by the local council air safety chairperson (LASC), who 
is appointed to a 2-year term by the local executive council (LEC) or the LEC 


chairperson. 

An airline’s central air safety committee is then made up of all of the LASCs 
from that airline’s various councils. The central air safety chairperson (CASC), 
appointed to a 2-year term by the master executive council (MEC) or MEC 
chairperson, presides over the committee, which handles unresolved problems 
from the local councils and those broader in scope than local issues. 

The national safety structure of the Air Line Pilots Association is composed 
of five management groups, headed up by Executive Air Safety Chairman, in 
these specific safety areas: 


e Aircraft Design and Operations 
e Airport and Ground Environment 
e Air Traffic Services 


e Human Factors and Training Group 
e Accident Analysis 


The Accident Investigation Board of the Air Line Pilots Association oversees 
investigation of accidents involving the air carriers they represent. The board 
coordinates ALPA’s participation in accident or incident investigations 
conducted by the NTSB or the FAA and ensures that the appropriate ALPA 
subgroup determines the significant factors in each air carrier accident. ALPA 
also maintains a worldwide accident/incident hotline for its pilots to call for help 
if involved in an aircraft critical safety event. If deemed necessary, ALPA will 
also employ its Critical Incident Response Program (CIRP), which counts on 
trained counselors who work to mitigate the psychological effect of an accident 
before harmful stress occurs. 

More specific to SMS, since 2008, ALPA has been a leader in supporting 
SMS principles as set forth in the ICAO Safety Management Manual. The 
ALPA policy statement is that they support SMS when it is developed and 
implemented in accordance with the following: 


e A documented, clearly defined commitment to the SMS from the CEO—a 
written SMS policy, signed by the CEO, which recognizes the business 
benefit of asset preservation and mishap prevention. The policy must show 
commitment to continuous improvement in the level of safety, management of 
risk, and creation of a strong safety culture. 


e Documented lines of safety accountability. 


e Active involvement of the affected employees in a nonpunitive reporting 
system and a commitment to a “just” safety culture. 


e A documented, robust Safety Risk Management (SRM) program. The SRM 
program requires the participation of labor organization(s) as the 
representative of their employee groups in both the identification of hazards 
and in the development of risk mitigation strategies. 


e A documented process for collecting and analyzing safety data and 
implementing corrective action plans. 


e A documented method for continuous improvement of the SMS. 


(Source: ALPA Administrative Manual, Section 80, Part 1, page 18, 
www.alpa.org) 


Working to maintain the highest levels of airline safety is an enormous 
challenge. The depth and breadth of ALPA’s air safety structure, and the critical 
role it plays in meeting that challenge, are unique in the air transportation 
industry. 

Pilot unions are just one of several, powerful and resource-rich labor 
organizations that can be used as an extension of an airline’s SMS. Aviation 
maintenance technicians often work as part of labor unions, as with the 
International Association of Machinists and Aerospace Workers (IAMAW), 
which represent over 600,000 workers in more than 200 industries. The 
IAMAW’s Safety & Health Department has promoted safety in topics such as 
hazardous material, occupational health, and as proponents of the Ground 
Operations Safety Action Program. Safety leaders in the Association of Flight 
Attendants (AFA) have been strong champions of finding better ways of 
managing crewmember fatigue, investigating aircraft cabin air quality, fighting 
the spread of communicable diseases, and passenger security screening. After 
all, as shown in Figure 12-6, flight attendants often have the best perspective of 
issues affecting passenger safety on a routine basis, such as turbulence and 
health ailments. AFA is the world’s largest labor union for flight attendants and 
represents nearly 50,000 cabin crewmembers at 18 airlines. 


FIGURE 12-6 Flight attendant performing a pre-departure passenger safety briefing. (Source: Wikimedia 
Commons) 


Whether they are safety leaders in pilot unions, maintenance technician 
unions, flight attendant unions, or other organized labor groups, individuals who 
perform safety work for labor unions are often highly motivated to find solutions 
and can contribute greatly to an airline’s SMS. 


COMPONENT #3: SAFETY ASSURANCE 


Once the risk assessment and controls are in place and “ALARP” has been 
declared, the SMS process shifts to the safety assurance side of the ledger to 
provide feedback on how the safety risk management process is performing. By 
leveraging efficiencies gained in SMS data and combining cross-functional 
trends into a centralized safety database, safety professionals can analyze what is 
happening over time better and target their mitigations strategically. If 
performing well, the safety assurance process provides positive reinforcement 
that risks are properly managed. However, new hazards may inadvertently be 
introduced into an SMS whenever a change occurs. 

There are numerous sad examples from safety history that demonstrate how 
the best of intentions for risk mitigation end up introducing new hazards into 


operations. One example that some readers may be familiar with is how the 
introduction of air bags in cars initially caused serious injury or death to small 
people when the air bags activated for collisions. An aviation example of an 
unintended consequence from the actions taken to promote safety is the 
incredible precision available in modern flight deck avionics instrumentation. 
Such precision is usually quite helpful to promoting safety, but the Gol Airlines 
and Embraer jet midair collision over Brazil in 2011 pointed out the midair risk 
of two aircraft flying at the exact same altitude over the same point in time. Had 
the altimeter or navigation systems been less precise the accident may not have 
occurred. Also, a mature risk mitigation process which is ostensibly under 
control may become unsafe when faced with changes to the system. 
Furthermore, a new operational procedure or system change needs to be verified 
by the safety risk management process to see whether it has an impact on other 
processes. One of the more important aspects of safety assurance is an effective 
formal change management system. 

As previously mentioned, a key aspect of change management is being able to 
measure what effect we have had with actions taken to sustain or enhance safety. 
It has been stated as a matter of truth that the only thing constant in aviation is 
that things will surely change. A formal process for managing these frequent 
changes is necessary for an efficient airline SMS program. Every airline should 
create and maintain a formal process that identifies changes that are occurring 
within the company that may impact previously developed processes. The 
formal change management system should consider how critical the system is to 
the airline, and whether the change introduces new, unforeseen hazards or risks. 

To determine whether change is occurring, and to detect whether it is 
happening to the benefit or detriment of risk management, safety performance 
monitoring and measurement is a critical part of an efficient SMS safety 
assurance process. After the hazards are identified and the risks are assessed, 
properly mitigated, and controlled, operational performance must be monitored 
and measured in order to ensure optimum effectiveness of the SMS. This is an 
internal process of the SMS team, focusing on data and information regarding 
the performance of the safety system. Finally, the last element of Safety 
Assurance is the continuous improvement of the SMS operation. Quality 
feedback monitoring processes are strongly recommended by both ICAO and the 
FAA to enhance the entire operation of the system. 


SAFETY PERFORMANCE INDICATORS 


It is tricky to measure how well SMS is working because health does not 


necessarily correlate to a reduction in the number of accidents. As a result, a key 
component of the SMS model that was adopted from the business realm is the 
use of performance indicators to assess the effectiveness of safety programs. 
Under SMS these are called safety performance indicators (SPIs). ICAO Annex 
19 defines an SPI as “a data based safety parameter used for monitoring and 
assessing safety performance.” It measures whether or not a system is operating 
in accordance with the goals of the safety program as opposed to simply meeting 
regulatory requirements. Using SPIs represent a shift from traditional data 
collection and analysis methods to the development of mechanisms that 
continuously monitor safety risks, detect emerging safety risks, and determine 
any necessary corrective actions. 

Unfortunately, the ICAO Safety Management Manual only provides the 
definition and guidance on the use of SPIs with a few generic examples. 
Consequently, individual organizations must develop their own meaningful 
measurements. There are several traits that determine a well-crafted SPI. An SPI, 
if properly created, for the organization: 


e Gives direct and unambiguous information on the specific item being 
measured. 


e Draws attention to dangerous trends and events. 

e Adds value to the safety performance. 

e Analyzes both internal and external factors that can impact safety controls. 
e Aligns with an organization’s safety targets. 


e Measures what they are intended to measure. 
e Is responsive to changes and statistically significant. 


The challenge of creating SPIs lies in narrowing the focus of a specific 
measurement. Organizations should focus on selecting indicators that can impact 
future operations from the unwanted events that they are trying to eliminate. 
Each SPI should be created for a different purpose, and the more critical the 
issue, the narrower the focus should be. 

Every organization has the flexibility to create its own SPIs and should do so 
according to its needs and operations, although some SPIs may be predetermined 
and required by a regulatory authority as a mandatory measurement. Flexibility 
is important because there are no predefined SPIs for specific aeronautical 
services. This characteristic enables organizations to develop the cornerstone for 
their performance-based oversight. Since ICAO’s verbiage lacks advice on 


creating SPIs, IATA is currently developing material to assist operators in this 
task. 

To provide an SPI example, Figure 12-7 shows a commercial jet operating in 
the vicinity of thunderstorms, which of course could produce inflight turbulence. 
Such operations are common in commercial aviation and an associated safety 
performance indicator chosen by the airline may depend on the culture and 
operational specifics for the organization. For example, one air carrier may 
choose to create an SPI that tracks the very few passenger injuries that occur due 
to turbulence, while another one may use an SPI that measures a wider number 
of incidents by tracking how many flight attendant injuries result from 
encounters with inflight turbulence. Another operator may prefer to create an 
even wider SPI that measures the number of unforecast turbulence encounters as 
reported by pilots, whereas another airline may prefer an SPI that measures an 
even larger population of events, such as moderate and severe turbulence 
encounters as measured through a flight data monitoring program. 
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FIGURE 12-7 A variety of SPIs could be created to manage the common problem of inflight turbulence. 
(Source: Wikimedia Commons) 


Creating SPIs paves the way for setting safety alert levels. Organizations 
should select statistical process control limits of the maximum number of safety 
events that can occur for them to still be operating within the acceptable range of 
safety. Statistical analysis of data from SPIs enables organizations to pick a 
quantifiable threshold for the alert zone. When the alert levels are reached, then 
there should be further investigations or a causal analysis combined with a plan 
that uses SMS tools to bring performance back to an acceptable safety level. 
Although alert levels are somewhat subjective, they can be very useful to help 
determine between significant and insignificant trends. 

As the aviation industry shifts to using SPIs, organizations will benefit from 
the conclusions they can derive from the metrics. This data will provide 
meaningful information that cannot be manipulated and that truly reflects 
operational trends. Additionally, the flexibility of customizing SPIs allows each 
organization to focus on its own operational context and challenges. 

Commercial aviation can use numerous data acquisition approaches for 
monitoring and measuring safety performance as part of an SMS, which include 
the following: 


1. Continuous monitoring comes from a variety of sources, but especially from 
line managers who are the technical experts in any organization. 


2. Internal audits are conducted by operating departments of the organization. 


3. Internal evaluation audits are conducted by people who are functionally 
independent of the process being evaluated. 

4. External audits are conducted by the FAA or by third-party organizations 
using tools that conform to standards agreed to by trade organizations. 

5. Investigations of accidents, incidents, or other safety-related events are 
conducted in a nonpunitive fashion to determine why the safety problem 
happened. 


6. An employee reporting system such as ASAP or other voluntary method is 
utilized. 


7. Analysis of data is conducted, especially to identify root causes of any 
nonconformance and to identify potential new hazards. 


8. System assessment is conducted to determine the safety performance and 
effectiveness of risk controls. 


AUDITS AND INSPECTIONS 


The mention of audits and inspections bears special discussion, because as noted 
above, a primary element of safety assurance is the need to continuously 
improve a company’s SMS. Rather than maintain the safety status quo, the SMS 
process seeks continuous improvement using tools such as internal evaluations 
and independent audits to obtain timely feedback information. Each SMS should 
create and maintain a formal process for detecting the reasons for substandard 
performance of the SMS and also to determining how that substandard 
performance impacts operations, in hopes of either eliminating the reasons 
altogether or at least making them less damaging. Continuous improvement can 
be greatly enhanced by a strong safety culture and committed management 
officials. Proactive evaluation of facilities, equipment and procedures, and 
vigilance are a must for SMS effectiveness. Continuous improvement of the 
SMS is a never ending goal and two overall processes can be used toward that 
end: 


e Preventative/corrective action assignments must be tracked and managed. 
This is an active process requiring routine follow-up and continuous 
assessment. 

e Top management review should be regularly conducted by the SMS 
Accountable Executive and other safety boards and committees at all levels of 
management. This review should include the inputs and outputs of SRM and 
the lessons learned from the safety assurance process. 


Analyzing and addressing hazards after they have materialized (caused 
accidents and injuries) are commonly referred to as a reactive approach to safety. 
The preferred proactive approach to safety requires that hazards and hazardous 
conditions be identified before they cause accidents and injuries. Using modern 
SMS strategies, the proactive approach to safety does not require a triggering 
event to take place. Instead, the proactive method aggressively seeks safety 
information to identify potential future problems. The ICAO Safety Management 
Manual illustrates these three safety management strategies detailed below. 

One way of accomplishing safety assurance in an SMS environment is 
through the comprehensive audit process. The words “audit” and “inspection” 
are often used interchangeably with some confusion about their definitions. Most 
schools of thought (including the authors of this text), however, consider an 
audit to be more comprehensive and have a greater scope of work than an 
inspection. While inspections usually identify workplace hazards, audits are 
designed to evaluate programs and management issues that have resulted, or 
could result, in workplace hazards. Safety audits are an integral part of a safety 


program, and in addition to uncovering hazards, audits reveal the level of 
compliance with regulatory standards as well as measure the effectiveness of the 
safety program. Some of the common approaches to auditing an airline or airport 
facility are as follows: 


e Comprehensive audits. These are extensive, detailed safety 
inspections/surveys (site conditions and programs) of the entire organization 
(an air carrier), a facility within an organization (an air carrier hub or 
maintenance facility), or an operation within a facility (fuel handling at the 
ramp). These audits are usually conducted on an annual basis by a team of 
safety professionals from within and outside the organization, facility, or site. 
They are usually led by the company safety director or the divisional or site 
safety manager. This type of audit results in a formal written report of 
findings and recommendations and usually requires a response within an 
agreed time frame. For example, Figure 12-8 shows a technician using a ball 
rotary file to modify a scallop ring so heat expansion will not cause cracking. 
An audit of an engine shop such as the one shown in the figure can help catch 
factors that lead to a deviation from established procedures and then produce 
recommendations to prevent a recurrence. 


FIGURE 12-8 The comprehensive audit of an engine shop can produce recommendations through 
observation. (Source: Wikimedia Commons) 


e Self-audits. These are informal daily, weekly, or monthly audits that resemble 
inspections and form the crux of the internal inspection program (IEP). The 
frequency of checks depends on the operation being assessed. For example, 
certain areas of airports have to be checked several times per day, whereas 
some operations in a hangar or on the ramp may only require one inspection 
each day. These audits are conducted by on-site line management at a given 
facility and usually result in a checklist of items that either are in acceptable 
condition or need fixing. No reports are normally generated as part of these 
audits. One of the functions of the Director of Safety is to help set up and 
provide expertise to local internal inspection teams. 


e Status audits. These audits are intended to determine the status of compliance 
at the time of observation. These are usually subject-oriented audits and are 
conducted in areas of high risk and/or areas of known or perceived concern. 
Evaluating a welding operation is an example of a status audit. These audits 
may generate reports if the findings are serious enough to require 
management’s attention. 


COMPONENT #4: SAFETY PROMOTION 


An integral part of a strong SMS culture is safety promotion. If the attitude of 
employees is that the program is only for compliance with regulations, then 
regard for safety and the SMS will not permeate through all aspects of daily 
operations. For this reason, the final component of SMS calls for the airline to 
continuously promote safety as a core value of the organization. 

The building blocks of a good program are depicted in Figure 12-9, and 
training programs should be tailored to an employee’s job function in the 
organization. The left-most block in the figure describes how operational 
personnel should understand the airline’s safety policy and have at least a 
functional understanding of how SMS operates. Added to that, the center block 
in the figure portrays how managers and supervisors must also have a more in- 
depth understanding of the safety processes used by their airline to include 
hazards identification and change management to address the risk associated 
with such hazards. Lastly, the right-most block of the figure depicts how senior 
managers must go beyond SMS fundamentals to ensure that organizational 
standards and regulations are observed. 
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FIGURE 12-9 Safety training and education fundamentals. (Source: ICAO) 


SAFETY TRAINING AND EDUCATION 


Within the safety promotion component of SMS, there needs to be a formal and 
recurrent process for training employees in safety. This requires creating and 
maintaining a safety training program that ensures personnel are trained and 
competent to perform SMS duties. The scope of the safety training should be 
appropriate to each individual’s role in the SMS, meaning that the training 
programs should be customized to the different roles played by employee groups 
in the organization. An aviation maintenance technician working in a hangar and 
a customer service agent staffing a check-in counter at the terminal will naturally 
have different impacts on the SMS of their airline and need to be trained on how 
their role impacts the safety of the operation. It is important to note that the AE 
should also receive special SMS training regarding roles and responsibilities, 
including an understanding of the SMS and its relationship to the organization’s 
overall business strategy. 

Safety training is most effective when it is integrated into a company’s 
performance and job practice requirements. The following important, yet 
common, guidelines should be noted and adhered to by organizations: 


e The company’s policy should clearly state the company’s commitment to 
safety. 


e The training should be conducted on paid work time. 


e Training must be in the language that the employee understands and should be 
delivered at an appropriate pace and comprehension level. 


e Employees and management should be involved in developing training 
programs. 


e Training should be conducted based on identified needs. 


e Training should have clearly defined goals. 


e Training should follow good teaching pedagogues and should incorporate the 
following basic principles: 

e The attendee must understand the purpose of the instruction. 

e The information should be organized to maximize understanding. 

e “Hands-on” experiences should be embedded whenever possible. 

e The training should be designed for different learning styles, such as 
written instruction, audiovisual instruction, hands-on exercises, and group 
learning assignments. Straight lectures should be no more than 20 minutes 
long. 

e Key concepts should be repeated for reinforcement. 


e There should be an evaluation component to training. Both the attendees and 
the training itself should be evaluated. Attendees can be evaluated through 
tests, quizzes, assignments, etc. Course evaluation questionnaires/surveys can 
be used to evaluate course content and its ability to achieve the stated goals. 


e All employee training records should be documented and maintained. This 
will help ensure that every employee who needs training receives it, that 
refresher courses are provided when needed, that documentation is available 
when required to prove that training was conducted (a regulatory requirement 
in some cases), and that the training was appropriate. Documentation should 
include the following: 

e The name and signature of the trained employee 

e The training date 

e The topic, including a brief lesson plan 

e Evidence of the employee’s successful completion 
e The name and signature of the trainer 


SAFETY COMMUNICATION 


A large part of safety promotion involves the critical need for communication. A 
robust SMS culture encourages a learning environment where employees 
communicate openly up and down the management chain without fear of 
reprisal. Each organization should create and maintain a formal means for safety 
communication that ensures that all personnel are fully aware of the SMS, 
conveys information that is critical to safety, explains why particular safety 
actions are taken, and details why safety procedures are introduced or changed. 
This guidance means that employees should have easy access to their 


organization’s SMS manual and associated safety process and procedures. 
Communication processes should also include airports and other providers of 
service to the airline. 

A healthy SMS may also feature safety newsletters, notices, and bulletins, 
plus the use of Web sites or e-mail to keep employees in the loop regarding 
safety issues and resolutions. Safety publications are an important component of 
a safety program. Most airlines publish regular internal safety documents to 
maintain high individual awareness of safety and risk management. Videos are 
also used to disseminate safety information to all employees. Communication 
and education are critical elements of any proactive safety program; there must 
be an effective mechanism in place to ensure the flow of critical safety 
information within the company. 

In conjunction with the safety risk management process, the communication 
of pertinent information necessary for reduction of the risk must be provided to 
the safety user. Depending on the type of risk involved, the user may be a pilot, 
flight attendant, aviation maintenance technician, or related support person. 
Recurring material failure causes, such as fuel pump failures, would probably 
only be distributed to technical services or the maintenance department, while 
human factors issues would be best communicated to all employee groups for 
example. 

Figure 12-10 shows a pair of aviation maintenance technicians working under 
the cowling of a Boeing 737-800 power plant. A safety manager viewing such an 
operation may contemplate what communication processes are used to relay 
important safety information to them and whether the corporate culture he or she 
is helping to create is one that encourages such technicians to freely report the 
hazards that they encounter. 


FIGURE 12-10 Empowering technicians to report hazards without fear of reprisals is a key aspect of a 
healthy SMS. (Source: Wikimedia Commons) 


Communication takes on many forms in an SMS. The airline safety, 
maintenance, and flight operations organizations are often mistakenly viewed as 
separate entities with little or no shared mutual interests, when in actuality, the 
three organizations are closely aligned by complex relationships as will be 
shown in the ASRS examples later in this chapter. While the maintenance 
department provides virtually all the technological expertise necessary to 
maintain the aircraft fleet, the pilots and flight attendants are its end use 
customers and, therefore, must maintain a user’s level of technical knowledge 
and related safety issues. 

Another key link of the relationship is forged by the airworthiness concept. 
While the captain is responsible for ensuring the final airworthiness and safety of 
the aircraft, it is the maintenance department that maintains or returns an aircraft 
to an airworthy condition. A fundamental component of this link is the aircraft 
logbook. which serves to document the status. degradation. and restoration of the 


aircraft between variable levels of serviceability. 

The third component of the flight—maintenance-safety relationship is the 
regulatory-procedural link. Both procedural and technical regulatory issues must 
be closely coordinated. While regulatory requirements emanate from the FAA, 
they are often precipitated by NTSB investigative findings, thereby necessitating 
direct communication between agencies for effective implementation of 
evolving safety requirements. Because of the highly complex nature of modern 
aircraft, a means to quickly analyze and disseminate critical FAA and NTSB 
safety information is required. In addition, conduct of both major and minor 
technically oriented investigations will require in-depth and thorough 
coordination between these agencies. This is also true with foreign regulatory 
agencies; however, the specific processes vary widely between nations. 


HOW TO IMPLEMENT SMS: A PHASED APPROACH 


As noted earlier, 10 years ago, major U.S. Airlines were invited by the FAA to 
participate in the SMS Pilot Project to work closely with the FAA to establish a 
program of voluntary SMS implementation. Today we are in the midst of 
mandatory SMS implementation for FAR Part 21 airlines as previously 
described. The FAA provides further information on the current state of SMS 
Implementation as follows on its Web site: (www.faa.gov): 


14 CFR Part 5 specifies a basic set of processes integral to an effective SMS but does not specify 
particular methods for implementing these processes. In other words, the regulation defines “what” must 
be accomplished, not “how” it must be accomplished. The current FAA Advisory Circular entitled: 
“Safety Management Systems for Aviation Service Providers” Dated: 1/8/15 (FAA AC No: 120-92B) 
provides additional guidance on how the SMS may be developed to achieve the safety performance 
objectives outlined by your organization. As is demonstrated by this AC, there is no one-size-fits-all 
method for complying with the requirements of Part 5. This design is intentional, in that the Federal 
Aviation Administration (FAA) expects each air carrier to develop an SMS that works for its unique 
operation. 


The classic implementation roadmap is set forth in a four-phased process 
similar to that outlined by the FAA and in the ICAO Safety Management 
Manual. The phases of implementation are arranged into four levels of 
“maturity” similar to that developed in the proven capability maturity model for 
software engineering at Carnegie-Mellon University in Pittsburgh, PA. Figure 
12-11, from the FAA Web site, is an FAA depiction of this maturity model, 
which is further described. 
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FIGURE 12-11 FAA SMS maturity model. (Source: FAA) 


Each level of the SMS maturity model is explained as follows by the FAA: 


1. Level Zero: Orientation and commitment is not so much a level as a status. 
It indicates that the Aviation Product/Service Provider has not started 
formal SMS development or implementation and includes the time period 
between an Aviation Product/Service Provider’s first requests for 
information from the FAA on SMS implementation and when they commit 
to implementing an SMS. 


2. Level One: planning and organization. Level One begins when an Aviation 
Product/Service Provider’s Top Management commits to providing the 
resources necessary for full implementation of SMS throughout the 
organization. Two principal activities make up Level One: 


a. Gap Analysis: The first step in developing an SMS is for the 
organization to analyze its existing programs, systems, and activities 
with respect to the SMS functional expectations found in the SMS 
Framework. This analysis is a process and is called a “gap analysis,” 
the “gaps” being those elements in the SMS Framework that are not 
already being performed by the Aviation Service Provider. 


b. Implementation Plan: Once the gap analysis has been performed, an 
Implementation Plan is prepared. The Implementation Plan is simply a 
“road map” describing how the Aviation Service Provider intends to 
close the existing gaps by meeting the objectives and expectations in 
the SMS Framework. 

3. Level Two: reactive process, basic risk management. At this level, the 
Aviation Service Provider develops and implements a basic safety risk 
management process. Information acquisition, processing, and analysis 
functions are implemented and a tracking system for risk control and 
corrective actions are established. At this phase, the Aviation Service 
Provider develops an awareness of hazards and responds with appropriate 
systematic application of preventative or corrective actions. 


4. Level Three: proactive processes, looking ahead. At this level, the activities 
involved in the safety risk management process involve careful analysis of 
systems and tasks involved, identification of potential hazards in these 
functions, and development of risk controls. The risk management process 
developed at Level Two is used to analyze, document, and track these 


activities. At this level it can be said that the organization has a full-up, 
functioning SMS. 


5. Level Four: continuous improvement, continued assurance. The final level 
of SMS maturity is the continuous improvement level. Processes have been 
in place and their performance and effectiveness have been verified. The 
complete safety assurance processes, including continuous monitoring, and 
the remaining features of the other safety risk management and safety 
assurance processes are functioning. A major objective of a successful SMS 
is to attain and maintain this continuous improvement status for the life of 
the organization. (Source: www.faa.gov) 


FUTURE CHALLENGES 


Today, the transformation of commercial aviation safety into the SMS 
framework is in full swing on a global basis. Using quality principles as a 
successful guide, SMS will continue to employ new methods with empowerment 
of employees and positive safety culture techniques to obtain safety levels never 
before achieved in commercial aviation. 

This is not to say that there are no challenges ahead as SMS is integrated into 
daily operations. Stolzer and Goglia (2015) talk about some of these difficulties 
in their book, Safety Management Systems in Aviation, 2nd ed. A strong safety 


record is not necessarily an accurate predictor of future safety performance. 
Currently, the literature available about SMS leans more toward developing and 
implementing programs, and there is somewhat of a gap of information 
regarding how to measure its effectiveness (see, Chapter 12, Stolzer and Goglia 
(2015) entitled “SMS Effectiveness” for a detailed discussion). For example, 
early metrics for measuring effectiveness were more reactive and measured 
accidents and incidents after they occurred. That method did not lend way to 
preventing future problems from occurring. Strong evaluation programs, then, 
should be developed to focus on both strengths and weaknesses of the SMS 
program in an attempt to improve the system. Organizations should move away 
from trying to eliminate the things that go wrong and work toward making sure 
as many things as possible go right. Moving forward in the development of SMS 
programs, we could expect to see a shift toward investigating right methods and 
practices as opposed to focusing on the wrong way to do things. 

Currently, SMS effectiveness centers on the collection and aggregation of 
information from sources such as ASAP, FOQA, FAA surveillance, internal 
evaluation programs, and accident investigations. However, there is currently 
research assessing two new quantitative methods, both adopted from the 
business world, which could be used for future evaluation of SMS programs 
(Stolzer & Goglia, 2015, pp. 348-349). 


e The first quantitative method is data envelopment analysis (DEA), a powerful 
technique to evaluate and benchmark organizations. DEA relies on linear 
programming, which is frequently used in operations research to evaluate the 
effectiveness of certain operational segments of an organization. It does this 
by using a math algorithm to consider all the inputs and resources used by 
each segment of an organization and comparing the relationships of the 
variables involved. Stolzer and Goglia (2015) explain that DEA is particularly 
useful when comparing “best practices.” The benefits of DEA would be that 
multiple inputs and outputs could be compared, and peer measurement could 
be ascertained. 

e The second quantitative method of SMS effectiveness is Input-Output (IO) 
which analyzes the interdependencies between the various branches of an 
economy. Stolzer and Goglia (2015) state in their book that IO demonstrates 
how parts of a system are affected by any change in the system. Thus, the IO 
process would be very useful in the safety assurance phase of change 
management. 


Researchers at Embry-Riddle Aeronautical University are currently exploring 


these two methods for use on future SMS effectiveness studies. With the 
employment of these new DEA and IO tools, SMS effectiveness will be more 
scientific and less equivocal in the future. 

As the March 2018 deadline for implementing Part 121 SMS approaches, 
airlines must be open to changes in culture and shifts in management 
philosophies. First, to be successful, senior leadership must have a strong, visible 
commitment to the four SMS components, or the four “Pillars” upon which SMS 
is based. Executives must also adopt a more democratic style of management 
while maintaining that not all ideas will be accepted and implemented despite 
being appreciated and considered. Companies should ease employees into this 
system using the phased implementation process, thus allowing the 
organizational culture to adapt and evolve to these new concepts. Adopting this 
enlightened mindset as soon as possible will facilitate successful implementation 
and smooth SMS execution in the years ahead. 


ASRS EXAMPLES 


Following are some examples from NASA’s Aviation Safety Reporting System 
(ASRS), in the original text submitted, including grammatical errors. These 
reports demonstrate the look and feel of operations that do not comply with SMS 
principles. Notice that, although each scenario is complex, several blatant 
warning signs exist showing that the situation is not following best SMS 
practices. 


MAINTENANCE PROCEDURES AND FUEL SYSTEM MALFUNCTION 


Title: Vastly different perspectives on safety between maintenance and flight 
crew. 


In this report, a Boeing 737-800 First Officer discovers on the third leg of his flight that the fuel system is 
malfunctioning, causing fuel spills and uncontrolled fuel transfer between wings. A Maintenance 
Supervisor suggests that this situation is not mechanically possible, and the crew should take it flying and 
see what happens. The crew declines. 


I served as the Relief Pilot for this flight. The trip started off with the aircraft was over fueled by 1,000 
LBS by refueling personnel. A new Weight and Balance was obtained with the revised fuel weight and the 
flight departed uneventfully. The aircraft landed and refueled with no indications of a fuel system 
problem. Next leg was uneventful as well. While refueling ground personnel notified the pilots the 
aircraft was leaking something out of the left wing. I went to investigate while the Captain and First 
Officer remained in the cockpit. I observed fuel overflowing out the left wing at an extreme rate. I 
notified the Captain and at that same time refueling was terminated and the overflow condition ceased. I 
estimate 1,000-2,000 LBS were spilled. Clean up crews and Fire Department personnel began the clean 


up as we de-boarded the aircraft. The on board Mechanic began to troubleshoot the system. While 
troubleshooting, I along with the crew viewed fuel transferring from one wing to the other with the fuel 
valve switches closed. This was concerning due to the fact that if this occurred airborne the aircraft 
would become uncontrollable after 5-10 minutes due to the imbalance. The Captain and the mechanic 
went to Operations to call Maintenance after troubleshooting. I was present during the conversation with 
the Captain when he was discussing the issue with a Mechanic on the phone. The Captain explained that 
with this uncontrollable fuel transfer to one wing the aircraft would not be safe to fly until it was 
positively fixed. The discussion heated as the Captain said, “He was not going to take the Mechanic’s 
advice to go fly and see what happens airborne.” The conversation ended with the Captain explaining 
that the aircraft was not going to fly when he, the First Officer, the Relief Pilot and the on board 
Mechanic refuse to fly for safety. 


Following the phone call I talked with the Captain further about the phone call. He stated, the mechanic 
said this situation was not mechanically possible and the crew should take it flying and see what 
happens. He also told me the mechanic said, “Pilots what if situations too much.” The Captain and First 
Officer then taxied the aircraft to a new parking spot. When they returned they stated the fuel once again 
transferred uncontrollably to one wing. Not one member of the crew wanted to lose a day and desired to 
have their full planned layover, but safety dictated that it was not safe to fly that aircraft until the 
mechanical situation was positively identified and resolved. 


The whole crew was placed in a hotel for the night until a rescue flight arrived the next day. At that point 
we took the new aircraft and the rescue crew took our aircraft after the plane’s defuel valve was 
manually closed. Later I talked with two different on board mechanics. They said that the manual 
defueling handle broke open and that there was also a refueling valve that was broken. He also stated 
this aircraft had an issue prior to our flight. I have several safety concerns listed below as it relates to 
this situation. 


1. There was no write up in the aircraft logbook about any such fuel system 
issue prior to our flight so there was no way a crew would know of such 
issues before they take the aircraft. 


2. The over fueling of the aircraft initially may have been caused by the system 
actually being broken prior to the start of the flight and there are no 
procedures with refueling personnel to catch this problem. 


3. This issue could be occurring with our other aircraft in the fleet and there 
should be a fleet wide inspection of these system components. 


4. My last and greatest concern is with the Maintenance Supervisor who was 
on the call with the Captain and the potential lack of safety culture at the 
management level within the Maintenance Department. When the Captain 
states he is not comfortable to fly along with the entire crew to include the 
onboard mechanic then those statements should be listened to. Pushing a 
crew to fly the aircraft and see what happens is not an environment that 
promotes safety first and could end with disastrous results. That type of 
culture will cause the airline to lose an aircraft and lives. 


Question for the reader: Please explain the aspects of the scenario that did not 
follow SMS best practices. 


BOEING 757 STALL WARNING SYSTEM FAULT 


Title: Miscommunication from confusing maintenance directions. 


In this report, a Boeing 757-200 flight crew receives a message on their 
Engine Indicating and Crew Alerting System (EICAS), which is a large flight 
deck display, as they taxied for takeoff. They returned to the gate for 
maintenance action which ultimately required several days to complete after 
determining the fault was a severed wire to the First Officer’s stick shaker. 
When later advised by management that they could have legally flown the flight 
from Hawaii to the mainland and simply written up the message in the 
maintenance logbook, the captain, who was newly qualified in this type of 
aircraft, was incredulous and requested an explanation. 


I am new on the fleet with about 150 hours total time. My First Officer has many hours. During taxi out 
the First Officer performed flight control checks and observed a white STATUS message on the lower 
EICAS screen “WARN ELEX.” Neither of us had ever seen this message. I stopped the aircraft and 
parked the brakes. We found a pertinent MEL which seemed to apply. It showed that it was NOT flight 
crew placardable. I contacted Dispatch and Maintenance Control. Together we determined that we 
needed to return to the gate for maintenance action. Every time we moved the yoke fore and aft we got 
the WARN ELEX status message, and after we centered the yoke in the neutral position, the status 
message would go out after about 10 seconds. 


After almost three days of maintenance troubleshooting, parts shipments, and an imported maintenance 
crew from the mainland, a partially severed wire leading to the First Officer’s stick shaker about a foot 
below the First Officer’s yoke was found. The wire had only a few strands of wire connecting the two 
sides. Apparently, there was enough damage to trigger the WARN ELEX message, but enough wire left to 
activate the stick shaker when it was tested. Eventually, the mechanics manipulated the yoke enough that 
the damaged wire completely severed the remaining strands, and then the First Officer’s stick shaker 
would no longer work. The damaged wire was then properly repaired, and the problem was corrected, 
prior to an actual failure! That is how the system should work, when problems are identified and 
repaired before an actual failure takes place in the air! 


In the aftermath of this event, I have been told by very senior company management pilots that, in this 
event, I “could” have legally continued the operation to takeoff and fly across the ocean with the white 
WARN ELEX status message showing. They have told me that this is in compliance with Boeing’s 
procedures. 


I feel alarmed that this is true! The apparently applicable MEL shows this is not flight crew placardable. 
Perhaps there are “some” status messages where it would not be a safety issue to operate with a status 
message showing prior to takeoff, but who in their right mind would even consider taking off to fly across 
the ocean when the aircraft is telling you that there is an unknown problem with the stall warning 
system? Why would senior management pilots tell me that? This is such a “Black and White” safety issue 
to me that I am very concerned that some other Captain might have ignored this STATUS message, in 
compliance with Boeing and company procedures, and taken the aircraft to the mainland from the 
islands. In my event, there was an actual problem, which had we taken off, could have resulted in a real 
inflight failure of some part of our Stall Warning system. 


I think that there should be some disclaimer to the policy which allows crew to “disregard” status 


messages prior to takeoff. Obviously, some status messages are more important than others. I am totally 
comfortable with my decisions in this event, but I question the “safety” of a policy which clearly conflicts 
with the MEL, which states that I cannot flight crew placard this issue, but if it happens after “brake 
release,” and before takeoff, that I can just “ignore” it, as if it never happened. This is not a smart 
procedure, for sure. 


Question for the reader: Please explain what aspects of this scenario show 
strengths in the airline’s SMS and what parts show SMS weaknesses. 


CONCLUSION 


Despite aviation being one of the safest modes of transportation in the world, 
accidents still happen. To counter the accidents that do occur, over the past 
several decades, our industry has adopted new mindsets and practices to make 
the aviation environment a safer place. One important way we have done this is 
by requiring the adoption of SMS both on the international and domestic level. 
Although safety management as a practice has existed since the birth of aviation, 
SMS is a formal and standardized framework for managing a safety program 
based upon accepted business and scientific processes. 

Figure 12-12 shows the pilots of an Airbus A330 skimming over cloud tops. 
Such an image may be what first comes to mind when contemplating SMS in 
commercial aviation. The reality is that SMS starts deep in the back offices of air 
service providers where executives and safety professionals, often teamed with 
union safety representatives, work to adopt the tenets of SMS. The same occurs 
in aviation venues ranging from airports, maintenance offices, air traffic control 
towers, and all other aviation organizations. Each of those links in the 
commercial aviation safety value chain must have a robust and continuously 
improving SMS as their lifeblood. Otherwise, as the saying goes, a chain is only 
as strong as its weakest link. 


FIGURE 12-12 Pilots are but one of the many links in the commercial aviation safety value chain. (Source: 
Wikimedia Commons) 


The four components of SMS, as developed by ICAO and FAA, and adopted 
by many throughout the world, provide a systematic approach for achieving new 
levels of safety that were originally unattainable. Simply stated, Safety Policy 
means document it in writing, referring to the need to have key aspects of a 
given SMS readily available to employees as a written reference. Safety Risk 
Management is the means to hunt the hazards, then assess and mitigate the risks, 
referring to the fundamental need of having employees aggressively seek safety 
problems and having a means of effecting change to produce better conditions. 
Safety Assurance is the way to measure and improve it, referring to the need to 
use scientific principles to determine the value of the actual management 
processes being used. Lastly, but affecting all other components, Safety 
Promotion is the learning and sharing of everything in all the components. 

Although the road to SMS has been long and sometimes difficult, for students 
of SMS the future is very bright indeed. The next few years will bring increased 
international collaboration and employment opportunities. Aviation safety 
professionals will find that SMS is a journey of continuous improvement, not a 
final destination. 
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REVIEW QUESTIONS 
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Discuss the evolution of SMS principles. 

List and discuss the salient features of the Four Components of SMS. 
Explain how safety assurance relates to safety risk management. 
What is the concept of ALARP and why is it significant? 

Compare and contrast the differences between hazards and risks. 


Provide an example of why change management is such a critical aspect of 
SMS. 


7. Discuss which SMS component you think is the most important. Back up 
your answer with a specific example. 

8. Select a sample and very specific hazard for a commercial aviation operator. 
Assess the risk presented by the hazard and recommend several controls. 

9. Why is communication important to SMS? 

10. Describe the steps of the SMS maturity model used for SMS 
implementation. 

11. Discuss the future of Safety Management Systems in aviation to today’s 
aviation safety professional. 
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LEARNING OBJECTIVES 


After completing this chapter, you should be able to 


e Distinguish between security and safety. 

e List the categories of attacks on civil aviation. 

e Discuss the regulatory and legislative aspects of aviation security. 

e Explain the role of the Transportation Security Administration (TSA). 


e Discuss the role of intelligence gathering and analysis regarding the security 
threat. 


e Explain the mission of the National Counterterrorism Center (NCTC). 


e Discuss the importance of the Intelligence Reform and Terrorism Prevention 
Act of 2004 (IRTPA). 


e Discuss the theory and concepts behind aviation security technologies and 
strategies. 


e Elaborate on the threat of cyberattacks in the aviation community. 
e Detail measures that the aviation industry has taken to increase cybersecurity. 


INTRODUCTION 


“Security” and “safety” are often used by the public as interchangeable terms 
and sometimes are even considered synonymous topics. In modern society, the 
discussion of one invariably invokes references to the other. However, it is 
important to realize that there is a fundamental difference between the two terms. 
While the end objective of both safety and security is to prevent injuries, loss of 
life, and property damage by minimizing risk, safety practices are designed to 
prevent “unintentional” acts and harm whereas security practices are designed to 
avert “intentional” acts and harm. The intentional acts addressed in this chapter 
are focused on attacks against commercial aviation. While attacks on civil 


aviation can be carried out against airliners, airports, and airline offices, airliners 
have been the most common target for attacks. 
The spectrum of attacks on civil aviation includes the following: 


e Bombings, shooting, and other attacks at airports 


e Bombings, shooting, hijackings, and other attacks (e.g., commandeering) on 
aircraft on the ground or in flight 


e General-aviation and charter-aviation aircraft attacks 


e Off-airport facility attacks, such as to navigation aids or communication 
relays 


e Shootings (from the ground) at aircraft during takeoff and landing 
e Virtual or cybernetic attacks from remote locations 


An example of how a large-scale attack by a highly trained group of terrorists 
can completely bring commercial aviation to its knees occurred on September 
11, 2001, when al-Qaeda carried out four simultaneous and closely coordinated 
suicide hijacking attacks. Later that year, al-Qaeda announced that its number 
one goal was to incapacitate the U.S. economy. Although this was not the first 
act of terrorism directed toward airlines, it proved particularly detrimental to the 
global economy. Some of the financial repercussions associated with attacks on 
the airline industry include the need to reallocate resources to enhance security 
measures and the crippling of air transportation systems, all at an enormous cost 
to the airline industry. 

As we move into the next era of aviation, we expect to see more of a 
relatively new type of violence to emerge: the cyberattack. We therefore need to 
start thinking about not only protecting the physical components of the system, 
such as planes, people, and facilities, but also consider the security of 
technology, such as software and digital information. Cyberattack threats will 
pose a new set of challenges for keeping our airspace secure. In this chapter, we 
review the history of attacks against commercial aviation together with the 
regulations and security measures that have evolved to minimize the occurrence 
and severity of these attacks. Figure 13-1 shows TSA inspectors patrolling 
airside ramp gates at an airport. 
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FIGURE 13-1 TSA security inspectors on the job. (Source: TSA) 


REVIEW OF ATTACKS ON CIVIL AVIATION 


The first significant attack on commercial aviation dates back to 1930 when 
Peruvian revolutionaries seized a Fokker F-7 aircraft in South America. The 
incident received little attention and never resulted in any international effort to 
combat potential threats to international aviation. At the time of ICAO’s 
formation in Chicago in 1944, few foresaw aviation security threats as 
significant, and hence, it was not addressed. Until the mid-1960s, airlines and 
airports gave security matters little attention. Low-technology security measures, 
such as airport fences, were intended as a safety measure to separate aircraft 
from wildlife rather than terrorists. 

In the United States, only 12 commercial aircraft hijackings were attempted 
from 1930 to 1967, of which only seven were semi-successful (Dorey, 1987), 
and there were only 32 worldwide hijackings from 1961 through 1967. 
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In 1968 there was a surge of hijackings in the United States in which several 
flights traveling to the Caribbean were repeatedly detoured to Havana, Cuba. Of 
the 22 hijackings in 1968, 19 of these flights were redirected to Cuba. There 
were 290 hijacking attempts (successful and unsuccessful) worldwide during the 
4 years following 1968. The worst year occurred in 1969 when 33 regularly 
scheduled U.S. airliners were hijacked (seven of these attempts failed). By 1969, 
the number of U.S. passengers and crewmembers who were being detoured to 
Cuba totaled 1,359 (Moore, 1991). 

From 1947 to 1996 there were 1,098 total incidents of attacks on airliners, 
compared with 129 attacks on airports and 249 attacks on airline offices. Unlike 
attacks on airliners, attacks on airports (bombing and armed assaults) peaked in 
the 1977—1986 decade. With regard to the modes of attack, hijackings were by 
far the most common form of attack on commercial aviation. Hijackings 
constituted 87% (959 of 1,098) of all incidents on airliners during this 50-year 
period. The other significant forms of attack on airliners were bombings (on the 
ground or in midflight) and armed assault (shooting at aircraft on the ground or 
in flight, throwing hand grenades, etc.). 

Throughout those key decades of the 1960s through 1980s, the overall 
number of attacks against commercial aviation were on a decline, but the 
severity of these attacks grew increasingly worse. In fact, the 1980s can be 
considered a disastrous decade for commercial aviation security, since 25 planes 
were sabotaged by explosives, causing 1,237 casualties. Some of the more 
infamous incidents included the following: 


e Air India Flight 182 in 1985 was a Boeing 747 that exploded due to a bomb, 
causing the death of 329 people off the coast of Ireland. 


e The Korean Air Flight 858 disaster in 1987 in which 115 lost their lives due to 
a terrorist bomb exploding on a Boeing 707 in Asia. 


e Pan Am Flight 103 was an infamous bombing of a Boeing 747 in 1988 caused 
by a Libyan terrorist bomb in the baggage compartment over Lockerbie, 
Scotland (270 fatalities). 


e The bombing of UTA Flight 772 in 1989 over the Niger desert in Africa in 
which 171 were killed. 


¢ The bombing of Avianca Flight 203 in 1989 near Bogota in which 107 people 
died. 


In addition to these attacks, there were 17 other documented, failed attempts 


between 1982 and 1987, as noted in the President’s 1989 Commission Report on 
Aviation Security and Terrorism. By comparison, there were 650 deaths in the 
1970s and 286 deaths in the 1960s. Things cooled off in the 1990s only to give 
way to the events of September 11, 2001, when 2,996 victims were killed in the 
four separate terrorist acts that will be discussed later in this chapter. 

The increased severity of attacks on commercial aviation were the results of 
terrorists changing their tactics and philosophies and making use of new 
technologies. They gained access to more sophisticated and lethal technologies, 
such as automatic weapons and deadly plastic explosives. They attacked airports 
by using pistols and bazookas, and they developed numerous ingenious ways to 
turn innocuous-looking suitcases and radios into lethal bombs. The character of 
airline hijackings also changed from the lone hijacker of the early 1960s who 
was making a personal or political point to an organized terrorist tactic in the 
1970s. In the era leading up to September 11, 2001, hijacking for the most part 
did not usually cost the lives of hostages. The operating security philosophy was 
to negotiate with the hijackers until a peaceful settlement was reached, thereby 
minimizing casualties. 

One particularly memorable event in commercial aviation security history 
took place in June and July 1976 and is best known as Operation Entebbe. On 
July 4, 1976, an Air France Airbus 300 aircraft with 248 passengers aboard was 
successfully rescued from hijackers associated with the Popular Front for the 
Liberation of Palestine. The terrorists’ intent was to force the release of 
Palestinians and militants imprisoned by Israel in exchange for the hostages. The 
flight had started in Tel Aviv with a destination of Paris but was diverted to 
numerous locations before stopping at Entebbe, which was the main airport in 
the African country of Uganda. Although 148 non-Israeli hostages were 
released, 94 mostly Israeli passengers and the Air France crewmembers 
remained hostages and were at grave risk of being killed. In response, the Israel 
Defense Forces transported 100 commandos over 2,500 miles to effect a daring 
night-time rescue mission in Entebbe. After a week of planning, the 90-minute 
raid rescued 102 hostages, but unfortunately cost the life of the Israeli unit 
commander and three hostages. All the hijackers were killed (Dunstan, 2011). 
Figure 13-2 shows the moment when the released hostages made it to freedom. 


FIGURE 13-2 Air France hostages returning home after being rescued by Israeli commandos in Entebbe, 
Uganda. (Source: Wikimedia Commons) 


During the following decade, hijackings have been largely unsuccessful, and 
aircraft defenses have significantly improved. Flight attendants and pilots now 
receive extensive anti-hijacking training. Passengers have also helped prevent 
terrorists from igniting explosives, such as during the shoe bombing attempt of 
December 22, 2001, and the underwear bombing attempt of December 25, 2009. 
Hijackers have been arrested and brought to justice in nearly every incident since 
September 11, 2001. 


REGULATORY MOVEMENT 


The terrorist attacks of September 11, 2001 changed the Aviation Security 
(AVSEC) landscape across the globe on a permanent basis. There have been 
significant regulatory developments in the international arena and in U.S. policy 
along the way. The international developments will be discussed briefly, 
followed by a historical discussion of the evolution of aviation security in the 


United States. 


INTERNATIONAL RESPONSE TO TERRORISM 


As stated above, no one considered aviation security as a major issue at the time 
of the formation of ICAO at the Chicago Convention in 1944. The focus at that 
time was the planning and development of air transport to ensure safety of flight 
in international air navigation. Gradually, through a series of ICAO meetings 
and conferences, the international community began to focus on crimes 
committed onboard aircraft. Some major milestones of international aviation 
security include the following: 


e Tokyo Convention recognized the issues underlying offenses and certain other 
acts committed on board aircraft (1963) and authorized the airline captain to 
take appropriate action to restrain persons interfering with safety of flight. 


e Hague Convention, for the suppression of unlawful seizure of aircraft (1970), 
adopted 14 articles relating to hijacking and provided guidelines to 
governments dealing with this problem. 

e International Civil Aviation Organization (ICAO) Annex 17—SARP 
(Standard and Recommended Practice) entitled “Security-Safeguarding 
International Civil Aviation against Acts of Unlawful Interference” (1974). 
This SARP sets forth the basis for the ICAO Civil Aviation Security program 
and outlines the minimum standards for aviation security worldwide. It has 
been a living document, evolving with security problems around the world. 
ICAO Security Manual—(Doc 8973—testricted) is the primary document 
providing member States with guidance material to assist with the 
implementation of international security measures. The ninth edition is the 
most recent version and includes national organization and administration; 
recruitment, selection, and training; airport security, organization, program, 
and design requirements; preventive security measures; and crisis 
management and response to acts of unlawful interference. 


In recent years, ICAO has been deeply involved in strengthening worldwide 
aviation security. Some current developments are provided below; for future 
updates please visit www.icao.int/security. 


e During a United Nations Security Council meeting in September 2016, the 
group unanimously adopted UN Resolution 2309 (2016), which calls for 
closer collaboration to ensure the safety of all global air services and prevent 


terrorist attacks. To counter the ongoing danger posed by terrorism to civil 
aviation, the Security Council called on all States to work with each other and 
the International Civil Aviation Organization (ICAO) to continuously adapt 
measures to meet that “ever-evolving global threat” (www.un.org). 


e Along with enhanced screening, security checks, and facility security, the UN 
Security Council called for strengthened cooperation and information-sharing 
among States and a requirement that airlines provide advance passenger 
information to national authorities in order to track the movement of 
individuals identified by the counter terrorism committees. Regional and 
international cooperation on border control, law-enforcement, and criminal 
justice was also emphasized. 


e One of the major features of worldwide security is the ICAO Universal 
Security Audit Programme Continuous Monitoring Approach (USAP-CMA), 
which has an ongoing objective to promote global aviation security through 
continuous auditing and monitoring of member States’ aviation security 
performance. 


e The International Civil Aviation Organization (ICAO), International Air 
Transport Association (IATA), and Airports Council International (ACT) 
jointly convened the 25th AVSEC World Conference in Kuala Lumpur, 
Malaysia from October 25 to 27, 2016. More than 450 security representatives 
from around the world exchanged ideas and operational experiences, learned 
practical new skills, and put together the framework to create the future of 
aviation security. 


e IATA Security Management System (SeMS). This system sets out an 
organization’s security policies as an integral part of its business processes. 
SeMS is based on the same concepts used for Safety Management System 
(SMS). Developed in conjunction with an efficient threat assessment 
mechanism and risk management program, SeMS helps organizations develop 
proactive, efficient, and cost-effective security measures (www. iata.org). 


EVOLUTION OF AVIATION SECURITY IN THE UNITED STATES 


Similar to ICAO, the FAA response to aviation security has slowly evolved. This 
section will briefly discuss the history of aviation security in the United States 
and the changes brought about by the events of September 11, 2001. 


THE HIJACKING ERA (1968—1987). In response to the major increase in 
hijackings during this era, FAA began to beef up the Federal Aviation 


Regulations. Initially, airport security matters were governed under FAR Part 
139. Part 139 was mainly concerned with deterring mistaken entry of humans 
and animals into air operations areas. However, to stem the increase of 
hijackings during the 1970s, there was a need to specifically deter access to air 
operations areas by individuals and ground vehicles that were unauthorized to do 
so. The anti-hijacking preventive measures ultimately approved were expensive, 
but so were the acts that were being prevented. Fi shows a Federal 
Bureau of Investigation (FBI) Special Weapons and Tactics (SWAT) Team 
practicing an anti-hijacking response. 
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FIGURE 13-3 FBI anti-hijacking drill at a military air base. (Source: U.S. Air Force) 


AIR CARRIER SECURITY. On January 31, 1972, Federal Aviation Regulation 
(FAR) 121.538 was issued to cover the air carrier community. Within this rule, 
air carriers were required to adopt and implement a screening system that would 
detect weapons and explosives in carry-on baggage or worn by passengers. The 
carrier’s security program was required to do the following: 


e Prevent or deter unauthorized access to its aircraft 


e Ensure that a responsible agent or representative of the airline would check in 
baggage 

e Prevent cargo and checked baggage from being loaded aboard its aircraft 
unless they were handled in accordance with the certificate holder’s security 
procedures 


The Anti-hijacking or Air Transportation Security Act of 1974 provided the 
statutory basis for the rules requiring carriers to institute 100% screening of 
passenger and carry-on items and for airport operators to station at least one law 
enforcement officer at each passenger checkpoint during boarding and pre- 
boarding. Additionally, as part of its obligation under this Act, the FAA began a 
research and development program that emphasized the development of devices 
to protect air travelers against acts of criminal violence and aircraft piracy. 

Airlines not only had complete discretion on how they implemented these 
new requirements but also had the right to express their concerns and suggest 
changes based on trial and error. This resulted in the inconsistent application of 
regulations across the airline industry, and in early 1975, the Air Transportation 
Association sought to work out a single standard security program. Their effort 
produced the FAA’s Air Carrier Standard Security Program, which attempted to 
bring some structure to the diverse interpretations of the new rules. Today, the 
Transportation Security Administration (TSA) has continued this program now 
known as the Aircraft Operations Standard Security Program (AOSSP). 

The increase in the rate of hijackings during the late 1960s and early 1970s 
caused the public to exert pressure on the U.S. government to implement 
security procedures at airports and to mandate security requirements for U.S. air 
carriers. This resulted in the establishment of the Anti-Hijacking Program of the 
Federal Aviation Administration. One element of this program was the federal 
Air Marshal Program, which began as the Sky Marshal Program in 1968 and 
continued through the 1970s and part of the 1980s as a program that was initially 
instituted to stop hijackings to and from Cuba, given the dramatic political 
events that had taken place on the island in 1959 and subsequent years. 

The Air Marshal Program gained importance, however, after the hijacking of 
TWA Flight 847 in June 1985 when two Lebanese hijacked a Boeing 727 
departing from Athens and diverted it to Beirut, where they were joined by 
additional hijackers. During an excruciatingly long 2-week confrontation, the 
hijackers demanded the release of prisoners held by Israel and murdered Robert 
Stethem, a U.S. Navy diver who was a passenger aboard the plane. 


In response to this hostage nightmare and the rapid surge in the Middle East 
terrorism, President Ronald Reagan directed the Secretary of Transportation, in 
cooperation with the Secretary of State and the Attorney General, to immediately 
explore an expansion of the FAA’s armed Air Marshal Program aboard 
international flights for U.S. air carriers. On August 8, 1985, Congress enacted 
Public Law 99-83, the International Security and Development Cooperation Act, 
which established the explicit statutory basis for the FAA Federal Air Marshal 
Program and allowed for assessment of security at foreign airports and approval 
of foreign air carrier security programs. 

This statute authorized Federal Air Marshals to carry firearms on board and to 
make arrests without warrant for any offense against the United States 
committed in their presence, if they had reasonable basis to believe that the 
person to be arrested had committed or was committing a felony. Three weeks 
after the TWA Flight 847 hijacking, the FAA imposed new regulations requiring 
that all scheduled carriers and public charter operators carry Federal Air 
Marshals on a priority basis, without charge, and that they provide seating 
selected by the marshals, even though it might mean bumping full-fare 
passengers. Today TSA has assumed responsibility for the Federal Air Marshal 
Service whose mission is to detect, deter, and defeat hostile acts targeting U.S. 
air carriers, airports, passengers, and crews. Figure 13-4 shows air marshals in 
rigorous hand-to-hand combat training. 


FIGURE 13-4 Intensive federal air marshal training. (Source: TSA) 


THE BOMBING ERA (1988-2000). On December 21, 1988, Pan Am Flight 103 
exploded over the village of Lockerbie, Scotland, killing the 259 people aboard 
and 11 people on the ground, as well as damaging several residential buildings. 
As previously noted, the crash was due to the explosion of a terrorist bomb 
placed in the luggage compartment of the aircraft. It was asserted that the 
luggage was coming from passengers boarding in Frankfurt and from some 
possible suitcases transferred from Air Malta Flight 180 to Pan Am Flight 103 at 
the Frankfurt Airport. ire 13-5 shows some of the many pieces of debris that 
were scattered across parts of Scotland due to the high-altitude explosion that 
tore the aircraft apart. 


FIGURE 13-5 Part of the flight deck from Pan Am Flight 103 lying in a Scottish field. (Source: Wikimedia 
Commons) 


The major lesson learned from the Pan Am tragedy is the importance of 
reconciling baggage to passengers, which is sometimes called bag matching. 
U.S. carriers were required to conduct a positive baggage—passenger 
reconciliation in 1988 at designated international locations. According to 
investigation findings, the Pan Am tragedy occurred because the airline was x- 
raying all interline bags at certain international high-threat locations instead of 
conducting a reconciliation process and physically searching all unaccompanied 
bags. Because Pan Am did not identify and physically search all the 
unaccompanied interline bags, Flight 103 left Frankfurt with several extra bags, 
one of which contained a bomb. 

This failure was duly noted in the 1990 report of the United States’ 
Presidential Commission on Aviation Security and Terrorism, established in the 
aftermath of the disaster. The commission’s mandate was to comprehensively 
study and evaluate the practices and policy options with respect to preventing 
terrorist acts involving aviation. The commission made a number of 
recommendations to prevent the recurrence of such a tragedy. The Aviation 
Security Improvement Act of 1990 (U.S. Public Law 101-604), passed on 
November 16, 1990, implemented many of the recommendations of the 


commission. This Act has been described in the 1992 FAA Annual Report to 
Congress as perhaps the most comprehensive, far-reaching legislative initiative 
designed to improve all aspects of aviation security. It mandated many 
regulatory actions affecting several agencies, required new reports, created new 
organizations and staffing requirements, and empowered the FAA to promote 
and strengthen aviation security through an expedited, more focused research 
and development (R&D) program. 


WHITE HOUSE COMMISSION ON AVIATION SAFETY AND SECURITY, 1996. The late 
1990s witnessed significant changes in the direction and emphasis of aviation 
security in the United States. The triggering event for this new emphasis and 
importance was the catastrophic loss of TWA Flight 800 off Long Island, New 
York, in July 1996. The early model Boeing 747 was carrying 230 passengers 
and crew when it exploded minutes after departing John F. Kennedy 
International Airport, bound for Paris. The tremendous force of the explosion 
had torn the aircraft apart, and the disturbing recovery images, along with vivid 
eyewitness accounts, riveted the attention of a shocked U.S. public for many 
weeks fearing that a terrorist attack had occurred. Curiously, the FBI eventually 
ruled that TWA 800 was not the result of a terrorist act. Both the NTSB and FBI 
jointly investigated the event until it was ruled a matter of safety and not 
security, at which point the NTSB finished the investigation. 

Nevertheless, the traveling public was frightened, and the media questioned 
the perceived safety and security of domestic airline operations. Within weeks, 
President Clinton announced the creation of the White House Commission on 
Aviation Safety and Security (the Gore Commission) which outlined sweeping 
changes, calling for regulatory reform and additional research directed toward 
new, safer technologies. Special attention was given to an action plan to deploy 
new, high-technology machines to detect the most sophisticated explosives. The 
report included 57 recommendations, 31 dealing with improvements in security 
for the traveling public. The commission recommended that the federal 
government consider aviation security a national security concern. 


GLOBAL WAR ON TERRORISM (2001 TO PRESENT). On September 11, 2001, four 
passenger aircraft were hijacked and crashed by terrorists in a coordinated attack 
against the United States of America. The terrorist events of 2001 changed the 
face of aviation forever while fundamentally modifying the thinking and 
approach to security in the United States. The ramifications of the attacks extend 
beyond trends and measures of security in aviation and into all modes of 
transportation. 


The first airplane used in the attacks was American Airlines 767 (Flight 11), 
which was flying from Boston to Los Angeles when it was hijacked and flown 
into one of the World Trade Center towers. All 11 crewmembers, 76 passengers, 
and 5 hijackers were killed. The second jet that was crashed into the second 
World Trade Center tower was United Airlines 767 (Flight 175). All 9 
crewmembers, 51 passengers, and 5 hijackers were killed. The impacts against 
the towers, together with the heat generated from the explosion of the aircraft, 
caused both towers to collapse. The third aircraft was American Airlines 757 
(Flight 77) on a flight from Dulles to Los Angeles. It was hijacked and flown 
into the Pentagon, collapsing part of the structure. All 6 crewmembers, 53 
passengers, and 5 hijackers were killed. The fourth aircraft was United Airlines 
757 (Flight 93) on a flight from Newark to San Francisco. It was hijacked and 
crashed into a field near Pittsburgh. All 7 crewmembers, 34 passengers, and 4 
hijackers were killed. Figure 13-6 shows firefighters extinguishing the fire from 
the impact of the hijacked aircraft that crashed into the Pentagon at 
approximately 9:30 in the morning of September 11, 2001. Next, the U.S. 
response to these attacks will be discussed. 


FIGURE 13-6 Firefighters extinguishing flames at the Pentagon caused by a 9-11 attack. (Source: U.S. 
Marine Corps) 


THE 9-11 Commission. The National Commission on Terrorist Attacks upon the 
United States (the 9-11 Commission) was an independent, bipartisan commission 
created by Congress and the President to prepare a full and complete account of 
the circumstances surrounding the terrorist attacks, and to provide 
recommendations designed to guard against future attacks. The full 
comprehensive report of the commission was issued on July 22, 2004, consisting 
of 585 pages. The executive summary of the report, which is available on the 9- 
11 Commission’s Web site, outlines sweeping general and specific findings, plus 
numerous recommendations (w 

General findings: 


e Imagination. The most important failure was one of imagination. The 
Commission did not believe national leaders understood the gravity of the 


terrorist threat. 


e Policy. Terrorism was not the overriding national security concern for the 
U.S. government. 


e Capabilities. The United States tried to solve the al-Qaeda problem with old, 
insufficient, Cold War capabilities. 

e Management. The United States missed opportunities to thwart the 9-11 plot, 
and could not find a way to pool intelligence information. 


Specific weakness and adverse findings were made by the 9-11 Commission in 
the following areas: 


e Unsuccessful diplomacy. 

e Lack of military options. 

e Problems within the intelligence community. 
e Problems in the FBI. 

e Permeable borders and immigration controls. 
e Permeable aviation security system. 

e Al-Qaeda financing was not detected. 


e The United States had an improvised homeland defense and communication 
was poor at senior government levels. 


e Emergency response was determined and saved lives, but effective decision 
making in New York was hampered by poor communication and weak 
command and control. 


e Congress and the Executive Branch responded slowly to the rise of the 
transnational terrorism threat. 

e The Commission stated that at the time of the report (2004), the United States 
was more secure than on September 11, 2001, but even more measures could 
be taken; therefore, recommendations were issued as follows. 


The 9-11 Commission recommended that the United States should take the 
following steps: 


1. Attack terrorists and their organizations 
2. Prevent the continued growth of Islamic terrorism 


3. Protect against and prepare for future terrorist attacks 
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‘The 9-11 Commission specifically recommended the following: 


Creation of a National Counterterrorism Center 

Creation of a new National Intelligence Director 

Effective sharing of information across U.S. government agency boundaries 
Congressional action to improve oversight of homeland security 


Clarification of roles, missions, and authority between Department of 
Defense (DoD) and Department of Homeland Security (DHS) officials 
among other agencies 
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TRANSPORTATION SECURITY ADMINISTRATION 


On November 19, 2001, Congress enacted the Aviation and Transportation 
Security Act (ATSA), Public Law 107-71, 115 Stat. 597, which established the 
Transportation Security Administration (TSA) as an operating administration 
within the Department of Transportation (DOT). A year later, on November 28, 
2002, Congress enacted the Homeland Security Act Public Law 107-296, 117 
Stat. 745, which created the Department of Homeland Security (DHS) and is 
headed by a cabinet-level secretary. The TSA subsequently moved from the 
DOT to the DHS in March 2003 as part of a massive federal government 
integration of all agencies whose mission it was to prepare for, respond to, and 
protect the United States from domestic emergencies, especially terrorism. 

According to its Web site, the mission of the TSA is to protect the nation’s 
transportation systems to ensure freedom of movement for people and 
commerce. Security screening is at the heart of the TSA, which now numbers 
approximately well over 50,000 employees. The TSA conducts 100% passenger 
screening and handled 708 million people in 2015. The multiple layers of the 
TSA aviation security system include the following: 


e Airport document checkers. 
e Behavior detection officers. 


e Secure flight—the behind-the-scenes watch list which matches passenger 
names to government lists of suspected terrorists. 


e Federal Air Marshals who fly aboard selected U.S. commercial aircraft. 


e Federal Flight Deck Officers (FFDOs) who are pilots armed and trained by 
the Federal Air Marshal Service on the use of firearms and other tactics. 


e Crewmember self-defense training program available at over 20 sites across 


the country. 
e Mobile dog explosive detection teams, such as the one shown in Figure 13-7. 
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FIGURE 13-7 A mobile dog explosive detection team at Washington Dulles International Airport. (Source: 
TSA) 


e Air cargo programs and initiatives such as the Certified Cargo Screening 
program to allow the prescreening of cargo prior to arrival at the airport. This 
program is part of the Improving America’s Security Act of 2007, Public Law 
110-53, which implements the ambitious 9-11 Commission recommendation 
mandating 100% inspection of all air and sea cargo entering the United States. 


TSA REGULATIONS 


The TSA issues Transportation Security Regulations (TSRs), which are codified 
in 49 CFR Chapter XII, Parts 1500 through 1699. TSA regulations are broken 
out into subchapters. Subchapter A contains administrative and procedural rules. 


Subchapter B contains rules that apply to many modes of transportation. Rules 
for civil aviation security are contained in Subchapter C. 
Subchapter A, 49 CFR 1500, outlines and defines the terms used in the TSRs. 


e Part 1520 addresses the protection of sensitive security information. This part 
outlines the type of information that may not be released under the Freedom 
of Information Act. Contained in this section is the duty to protect any 
information that is given to a person in performance of his or her duties and 
the responsibility to report to TSA, DHS, or DOT when he or she becomes 
aware that sensitive security information has been released to unauthorized 
individuals. 


e Part 1540 outlines the Civil Aviation Security General Rules. Part 1540 also 
contains prohibitions regarding making fraudulent or intentionally false 
statements or entries in compliance reports. Also prohibited by Part 1540 is 
the interference with screening personnel while they are performing their 
duties and the carriage of weapons, explosives, or incendiaries by individuals 
into specified areas at airports. Other requirements outlined in Part 1540 are 
as follows: 

e The security responsibilities of employees and persons who access the 
airport 

e The responsibilities of persons who wish to enter any area that requires 
screening 

e The responsibility of airmen to present certain certifications to TSA for 
inspection when so requested 


e Part 1542 contains the regulations for airport security. These airport 
requirements primarily address access control, law enforcement support, and 
fingerprint-based criminal-history records checks, among other things. 


e Part 1544 addresses airport operator security for air carriers and commercial 
operators. Part 1544 requires that the aircraft operator not permit persons to 
have unauthorized explosives, incendiaries, or weapons when on board an 
aircraft. 


e Part 1546 provides the rules for foreign air carrier security including the 
screening of individuals and property, access to cargo, and bomb or air piracy 
threats. 


e Part 1548 provides the rules for indirect air carriers that operate within the 
United States, including the acceptance of cargo and security threat 
assessments. 


e Part 1550 was created to require security programs for both passenger and 
all-cargo operations using aircraft with a maximum certified takeoff weight of 
12,500 pounds or more. 


ROLE OF INTELLIGENCE 


The comprehensive 9-11 Commission Report details how al-Qaeda was allowed 
to become a real danger to the United States in the years preceding 2001. The 
attack was driven by Osama bin Laden, who built a dynamic and lethal terrorist 
organization over the course of a decade. The Report surprisingly concludes that 
“the 9-11 attacks were a shock, but they should not have come as a surprise.” 
The terrorists had given plenty of warning that they meant to kill Americans in 
great numbers. With 20/20 hindsight, it is clear that the 9-11 attacks were able to 
succeed due to a serious failure of the U.S. intelligence community. 


NATIONAL COUNTERTERRORISM CENTER 


A major recommendation of the 9-11 Commission was to build a “Unity of 
Effort” combining all strategic intelligence and operational planning under one 
office. The National Counterterrorism Center (NCTC) was established by 
Presidential Executive Order 13354 in August 2004. This order was codified into 
law by the Intelligence Reform and Terrorism Prevention Act of 2004 (IRTPA). 
The establishment of NCTC implements a key recommendation of the 9-11 
Commission as follows: 


Breaking the older mold of national government organization, this NCTC should be a center for joint 
operational planning and joint intelligence, staffed by personnel from the various agencies. (9-11 
Commission Report, p. 403) 


Today, the NCTC is manned on a 24x7 basis in a modern operations center 
collocated with the Central Intelligence Agency (CIA) and Federal Bureau of 
Investigation (FBI) operations centers. It is staffed by more than 500 personnel 
from over 16 different U.S. departments and agencies. The Director of NCTC 
has a unique, dual line of reporting: (1) to the President for counterterrorism 
planning and (2) to the Director of National Intelligence (DNI) regarding 
intelligence matters. The DNI began operations on April 22, 2005 as another 
major recommendation of the 9-11 Commission and the IRTPA legislation was 
implemented on that date. Today, the Director of National Intelligence serves as 
the single head of the intelligence community, overseeing such major 
intelligence offices as follows: 


e The Central Intelligence Agency 
e The Defense Intelligence Agency 


e The National Security Agency 
e The National Reconnaissance Office 


As stated on its Web site, the NCTC has a threefold mission to lead the effort 
to combat terrorism at home and abroad: 


1. Analyzing the threat 
2. Sharing information with intelligence partners 
3. Integrating all instruments of national power to ensure unity of effort 


National Counterterrorism Center analyzes the threat by integrating all 
counterterrorism intelligence from across the community, producing detailed 
analytic products such as the following: 


e President’s Daily Brief 


e National Terrorism Bulletin 
e Information on the chemical, biological, radiological, and nuclear threats 


National Counterterrorism Center shares information with U.S. intelligence 
agencies by conducting analysis of more than 30 dedicated intelligence networks 
located under one roof. It routinely makes these counterterrorism products 
available to the following: 


e Intelligence users in 75 U.S. government agencies through the NCTC 
Interagency Threat Analysis and Coordination Group 

e Intelligence users also obtain information by means of a daily secure video 
teleconference system on a 24x7, 365 days a year basis 


National Counterterrorism Center integrates all instruments of national power 
in the Global War on Terrorism through joint planning and strategic plans such 
as the following: 


e The National Implementation Plan for the War on Terror 
e The National Strategy for Aviation Security 


DEPARTMENT OF HOMELAND SECURITY 


The National Strategy for Aviation Security cited above details the 
comprehensive U.S. government strategy in this area. The DHS coordinates the 
operational implementation of this strategy, which is an overarching national 
plan to optimize aviation security integration on a government-wide basis. Six 
supporting plans, listed below, have been issued to ensure collaborative 
interagency effort. (Please see www.dhs.gov for the latest information.) 


Aviation Transportation System Security Plan (DHS and DOT) 

Aviation Operational Threat Response Plan (DoD and DoJ) 

Aviation Transportation System Recovery Plan (DHS and DOT) 

Air Domain Surveillance and Intelligence Integration Plan (DoD and DNI) 
Domestic Outreach Plan (DHS and DOT) 

International Outreach Plan (DOS) 
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REVIEW OF SECURITY TECHNOLOGIES 


To strengthen commercial aviation security, numerous technologies have been 
fielded and others are under development. The first stage of the deployment of 
new, advanced security equipment began in 1997 when Congress appropriated 
$144 million to this end. After the events of September 11, 2001, the 
implementation plan was sped up, and all airports were required to install 
baggage and passenger screening equipment by December 2002. TSA began 
deploying state-of-the-art Advanced Imaging Technology (AIT) in 2007. In 
March 2010, TSA started deploying AIT units which were purchased under the 
$1 billion appropriation to TSA, authorized by the American Recovery and 
Reinvestment Act jobs program brought about by the worldwide recession of 
2009-2010. 

Protection from the threat of explosives is of particular interest and has been 
pursued in two general ways: by preventing explosives from reaching the 
aircraft, such as by using explosives detection technologies, or by mitigating the 
effects of an explosive by protecting the aircraft from an onboard explosion such 
as Via aircraft hardening and hardened containers. While each of these 
approaches will be discussed individually, a combination of these two 
approaches may provide the best protection of commercial aviation. In some 
cases, technologies can be used for detecting several threats, such as imaging 
detectors that search for explosives, knives, and firearms. 


IMAGING TECHNOLOGIES 


Imaging technologies work either by sensing the natural radiation emitted by the 
human body (millimeter wave) or by exposing subjects to a specific type of 
radiation and then measuring the radiation reflected by the body (backscatter). 
These systems can detect metallic weapons or plastic explosives by sensing the 
differences in reflected radiation between the human body and the weapons or 
explosives. The screening systems then generate television-like digital images. 
Operators are trained to identify potential threat objects in these images, often 
with the assistance of image-enhancing software that highlights unusual features. 
Figure 13-8 shows a security officer at an airport scrutinizing an image from a 
baggage screening x-ray system. 


F 


FIGURE 13-8 A TSA security screener examining an image at an airport. (Source: TSA) 


FuLL Bopy SCAN. Transportation Security Administration uses two types of 
advanced imaging technology today, millimeter wave and backscatter x-ray 
technology. Millimeter-wave scanners come in two varieties: active and passive. 
Active scanners predominate the market; passive technology is still under 
development. Active scanners work much like radar, they direct millimeter wave 
energy at the passenger and then interpret the reflected energy. Since modern 


scanners can display images that reveal private parts of the human anatomy, 
some privacy objections were raised by the public when awareness of the 
technology became public. To alleviate the privacy concerns, in February 2011 
the TSA began testing a new software system on its AIT machines which 
eliminates passenger-specific images, and instead, “auto-detects” potential threat 
items and indicates their location on a generic outline of a person. The generic 
outline is identical for all passengers. If no potential threat items are detected, an 
“OK” will appear on the monitor with no outline of the body. 

Backscatter x-ray imaging is also used for full body scanning by detecting 
radiation reflected from the passenger. X-ray units used for inspecting carry-on 
luggage and people employ low-dosage, low-energy radiation. Higher dosage 
units are used for checked baggage. Older generation units produced images of 
low quality and poor contrast. Most of the older analog systems have given way 
to modern digital video amplification and processing systems that produce 
clearer images and increased contrast ratios. On its Web site, the TSA assures 
the public that current technologies are safe and meet national health and safety 
standards. TSA states that the energy projected by millimeter wave technology is 
thousands of times less than a cell phone transmission. A single scan using only 
backscatter technology produces exposure equivalent to 2 minutes of flying on a 
plane. 


EXPLOSIVE TRACE DETECTION TECHNOLOGY 


Explosive trace detection technologies are based on the direct chemical 
identification of either particles of explosive material or vapor-containing 
explosive material. Thus, the presence of a threat object or bomb is inferred from 
the presence of particulate matter or vapor. The main difference between trace 
detection and electromagnetic imaging is that in trace detection a sample of the 
explosive material must be transported to the instrument in concentrations that 
exceed the detection limit. 

Trace detection technologies cannot be used to detect the presence of metallic 
weapons. All trace detection equipment is regulated by TSR Part 1544.213. The 
two distinct steps in trace detection are sample collection and chemical 
identification. Trace detection practices are more commonly used for baggage 
screening, as opposed to people screening, in aviation security. Some basics of 
this technology are discussed next. 


SAMPLE COLLECTION. Explosive substances can be detected by instrumentation 
in their vapor or solid form. Initial efforts in the development of trace detection 


technology were focused on collecting vapor around the person or baggage. 
However, because many modern explosives do not readily give off vapor at 
room temperature, the focus has expanded to include detection of particulates of 
explosive materials on the skin and other surfaces. 

If traces of explosive material are to be detected, they must be concentrated 
from an air sample or dislodged from a substrate. The air sample, called vapor 
detection, requires large amounts of air to be collected, from which small 
amounts of the substances of interest are extracted. The substrate sample, called 
particle detection, requires pieces of explosive material to be removed from the 
surface to which they are adhering. Both trace detection approaches have 
strengths and weaknesses depending on the type of explosive material being 
sought. Vapor technologies are more effective for detecting explosive materials 
with high vapor pressures, while particulate technologies are more appropriate 
for detecting explosive materials with low vapor pressure such as military-style 
plastic explosives. 

Samples can be taken either by having the subject walk through a portal (the 
puffer machine approach) or by passing a hand-wand device over the subject or 
piece of baggage (the swab approach). Either method may be implemented as a 
contact or noncontact technique. In contact portal sampling, passengers walk 
through a portal by pushing open a door or by rubbing against paddles or 
brushes. In a noncontact system, an airstream passes over the passengers as they 
walk through the portal. Hand-wand devices may be used to sample air around 
the person or to make physical contact. In general, contact methods focus on 
gathering particulates of explosive material from the hands or clothing of the 
subject. Noncontact methods may use the airstream to dislodge particles, or they 
may distill a sample of explosive vapor from the airstream. 

Although using a hand-wand device is a potentially efficient sample 
collection technique, it is more labor-intensive and more time-consuming than 
collecting samples by using an automated portal. The optimum solution may be 
to attach a hand-wand device to a portal-based trace detection system as a 
higher-level surveillance accessory. This is a common technique used with metal 
detection portals. In trace detection, a single chemical-identification instrument 
could be served by both the portal and the hand-wand device sample collection 
mechanisms. 

Transportation Security Administration is expanding its use of explosive trace 
detection, especially using the swab approach. To ensure the health of TSA 
workers, swabs are disposed of after each use. When tested, the swab is placed 
inside a fixed or portable machine which analyzes the content for potential 


explosive residue. American Recovery and Reinvestment Act funding is also 
being used to purchase additional explosive trace detection equipment. Figure 
13-9 shows a security officer at an airport checking for traces of explosives 
found on a passenger. 
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FIGURE 13-9 A security screener checking for traces of explosives. (Source: TSA) 


EXPLOSIVE DETECTION SYSTEMS (EDSs) 


Bulk explosive detection systems (EDSs) include any device or system that 
remotely senses a physical or chemical property (or combination thereof) of an 
object in an attempt to detect the presence of an explosive concealed in a 
container (e.g., passenger baggage). Today TSA screens 100% of all baggage 
placed on an airplane, often covering 2 million passengers processed each day. 
This equipment must function without causing unreasonable delays, so reliability 
and throughput are very important. 

There have been major improvements in EDS baggage screening technology 
in recent years. TSA has recognized this trend and has fostered technology 
improvement through priority funding provided by the American Recovery and 
Reinvestment Act. In fact, a new standard has evolved in this area of Checked 


Baggage Inspection Systems (CBIS). At present, average in-line, medium speed 
equipment can inspect around 600 bags per hour. TSA standard for high-volume 
screening is a throughput of at least 900 bags per hour with a low, false alarm 
rate. 

Companies are meeting this challenge by providing improved image quality 
and on-screen resolution using three-dimensional (3D) images very similar to the 
magnetic resonance imaging (MRI) technology used in medical radiology 
offices today. In-line checked baggage systems of the future will be extremely 
efficient, able to achieve a throughput of over 1,000 bags per hour, and easier to 
maintain with built-in diagnostics tools. These high-speed screening systems will 
also be upgradable and allow airports to increase baggage handling capability 
without major capital investments. 


METAL DETECTORS 


Screening procedures currently used in U.S. airports, at least during routine 
operations, involve metal detection portals for screening passengers and x-ray 
imaging systems for screening hand-carried baggage. Metal detection devices 
impose a time-varying magnetic field in the space within the portal that induces 
eddy currents in metallic or ferromagnetic objects passing through that space. 
Various methods are used to detect these eddy currents, and when they exceed a 
preset level, an audible or visual alarm goes off, and an operator intervenes to 
ascertain the presence or absence of a dangerous object or weapon. The 
effectiveness of this security screening system depends not only on the 
performance of the equipment, but also on the performance of the personnel 
operating the equipment and resolving the alarms. 

Metal detectors vary from portals to handheld systems depending on the 
application and size of the airport. Most passengers are required to pass through 
a portal-type metal detector, but a more scrutinized search could be conducted 
with a handheld or portable metal detector. Metal detectors are not as effective 
as other systems, and their deficiency lies in their inability to catch all forms of 
dangerous weapons. Their greatest weakness is that they do not detect metals 
incapable of being magnetized. Newer-generation metal detectors can search for 
ferrous or nonferrous objects. Metal detectors are used broadly around all the 
airports and are one of the most important sources of security. 

An important advance in metal detectors is the multizone concept. Through a 
multizone approach for portal-type metal detectors, sensitivity can be assigned to 
specific areas of the body zones that the metal detector would scan. Each zone 
has its own sensitivity adjustment. This permits the detection response of each 


zone to be independently adjusted. The horizontal zone corresponding to the foot 
region of the body can be made more or less sensitive than the waist region or 
vice versa. Use of metal detectors in airport security is regulated by TSA under 
its Part 1544.209. Figure 13-10 shows a sample of some of the loaded firearms 
that have been detected and confiscated during airport security screening. 


FIGURE 13-10 Some of the many weapons and ammunition caught by security screeners at airports. 
(Source: TSA) 


BIOMETRICS AND FUTURE CHECKPOINT SYSTEMS 


The term biometrics refers to the emerging field of technology devoted to 
identifying individuals by using biological traits such as those based on retinal or 
iris scanning, fingerprints, or face recognition. Biometric technology is defined 
as the automated use of physiological or behavioral characteristics to determine 
or verify identity. This technology has been used in place of passwords by some 
government agencies but increasingly finds uses in a wide range of security 
applications, such as preventing unauthorized employees from gaining access to 
certain areas and assets. Another use is to quickly identify low-risk users, such 
as prescreened airport passengers, so that security personnel can focus on the 
much smaller category of “high-risk” passengers. 

Biometric systems are basically of two types: verification and recognition. By 
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a biometric identification. Verification systems require that the individual 
seeking access have some sort of identification, such as a smart e-card, that is 
then matched with some physical characteristic of that person to make the 
verification. A reference measurement of the biometric is obtained when the 
individual is programmed into the device. 

In addition to using biometric contractors, TSA has chosen to focus on the 9- 
11 Commission recommendation that the government take over the No Fly 
Watch List system. This is the careful computer screening of passenger 
information by comparing names to the federal government intelligence watch 
lists. The Intelligence Reform and Terrorist Prevention Act of 2004 (IRTPA) 
codified this recommendation so that as of November 1, 2010, the new TSA 
Secure Flight Program requires airlines to collect and transmit the following 
Secure Flight passenger data to TSA: 


e Name as it appears on government issued ID when traveling 
e Date of birth 


e Gender 

e Redress number (this is a special number given to passengers who have 
resolved denied boarding problems with the TSA to prevent future delays as a 
misidentified passenger) 


Many U.S. airports are now approved for Global Entry and TSA pre-check 
screening. Global Entry is a program of the U.S. Customs and Border Protection 
service that allows pre-approved, low-risk travelers to receive expedited 
clearance upon arrival into the United States. Passengers can enroll in these 
plans online and must also visit a government office for a background check and 
fingerprinting. In this expedited personal screening process, passengers do not 
have to remove shoes, laptop computers, small personal liquid containers, belts, 
or light jackets. Passengers who register for these programs are usually rewarded 
with a quick clearance through TSA security checkpoints. 


STRENGTHENING AIRCRAFT AND BAGGAGE CONTAINERS 


Another approach to aviation security is to try to strengthen aircraft frames and 
to plan redundancies in vital systems such as controls, electrical systems, and 
hydraulics to mitigate the effects of bomb blasts in flight. A further alternative is 
to use hardened baggage containers that can control the effects of bomb blasts in 
checked baggage. 


Retrofitting is difficult. It is easier and more practical to incorporate such 
design measures during the design stage of the aircraft. The FAA has engaged in 
extensive studies with military experts and airframe manufacturers to learn how 
aircraft fail due to explosions in flight and to discover measures to increase 
chances of aircraft survival. Explosive tests have been carried out by the FAA in 
the United States and in the United Kingdom to check calculations. 

Using hardened unit load devices (HULDs) to protect aircraft from explosive 
attacks is not a new concept. Airlines that operate in high-risk areas of the world 
have been using custom-built containers. Because these containers are much too 
heavy for general use, only one or two are used per aircraft for carrying select 
items. However, new advances in technology and the need for increased security 
after the terrorist attacks of 2001 have resulted in greater use of these containers. 
Even though a certified HULD is now available, the FAA has not developed a 
deployment plan for airline service. The idea of replacing all existing containers 
with HULDs has been abandoned because of its impracticality in terms of 
weight, cost, and operational factors. 


COCKPIT DOOR REINFORCEMENT 


On January 10, 2002, the FAA published new standards to protect cockpits from 
intrusion, small-arms fire, and fragmentation devices, such as grenades. The rule 
required U.S. airline operators to install reinforced doors by April 9, 2003. 
Congress appropriated $97 million to help the airlines defray the cost of cockpit 
door replacement. Current cockpit door regulations and security standards are 
found in 14 CFR Section 25.795. This single enhancement has proven to be a 
very successful measure to counter cockpit invasions. 


CYBERSECURITY 


Cyberspace is the environment in which communication occurs between and 
over computer networks. Such networks are vulnerable to both physical and 
remote cyberattacks, and the protection against such acts constitutes 
cybersecurity. It can be particularly challenging to defend against such attacks 
since terrorists can operate from anywhere in the world and can use inherent 
weaknesses in the numerous complex linkages between cyberspace and physical 
systems. Given that software and information technology are critical components 
of modern commercial aviation, to include the airport and air traffic systems, a 
new battlefront has been opened by terrorists in these areas. According to the 
U.S. Government Accountability Office report in 2015, cyberattacks have grown 


tenfold recently. In 2006 there were only 5,503 such incidents reported, 
compared to 60,753 in 2013. 

With the development of NextGen technologies underway, as described in 
Chapter 10, experts say there are multiple cybersecurity vulnerabilities in the 
new system. Whenever technology is increasingly automated, it needs to be 
integrated with the same degree of security. However, NextGen technologies 
still have significant security-control weaknesses that will be a threat to ensuring 
safe and uninterrupted operations. Replacing a radar-based air traffic control 
system with one that connects controllers and aircraft via data and satellite links 
will create an environment that is much more sensitive to a cyberattack. One 
NextGen technology endangered by this is ADS-B, which allows aircraft to 
determine its position and broadcast that information to other aircraft and ground 
controllers through satellite. The security issue here is that ADS-B is publicly 
accessible using real-time computer applications that have flight tracking. It 
could be easy for a hacker to create a fictitious aircraft in the system, which 
could confuse pilots and air traffic controllers. 

NextGen technology is not the only weak link in the aviation sector. Boeing 
787 and Airbus 380 electronic-enabled aircraft, also known as e-Enabled, will 
also raise security concerns. The systems in these planes are networked in real- 
time to ground stations and receive and transmit data that can influence 
navigation, maintenance performance, and airplane health back to stakeholders. 
This gives airplane power-plant manufacturers direct access to the engines while 
in flight for health monitoring and diagnoses. Everything is interconnected, from 
the transportation system to plane diagnostic entities. Unfortunately, 
manufacturers often do not perform sufficient cybersecurity testing prior to 
issuing an airworthiness certificate, which is the document that authorizes a 
plane to fly. That shortfall is problematic because planes are becoming less 
manually controlled and more technology based. However, there does not seem 
to be a regulatory remedy in the future due to the complexity of the issue and the 
required financial resources. 

Although the FAA, European Aviation Safety Agency (EASA), and 
Transport Canada rely on the RTCA certification, DO-178C for guidance on 
aviation software, the document does not specifically address airborne network 
and data security. This shortfall has the potential to create nonstandardized and 
potentially unfair agreements between various users and the regulatory agencies 
for an acceptable process for the compliance of safe, secure, and efficient 
network design and operations. 

Thus, in an effort to strengthen our fight against cyberattacks, we must focus 


on two measures. First, the industry must adapt its technology. Companies must 
take into account the whole threat life cycle, which includes building the best 
protection and recognizing threats as the environment changes. For example, 
Boeing took proactive measures against threats by requesting the FAA to issue 
special conditions for its Model 777-200, -300, and -300ER after detecting 
vulnerabilities in the avionics systems. Another example is the use of threat 
modeling, a technique that assists software engineers in identifying and 
documenting potential security threats. Threat modeling provides development 
teams with a way of finding strengths and weaknesses in software applications 
through visual representations of the system. 

The second measure to counter cyberattacks is through increasing 
cybersecurity awareness. Businesses must be willing to share information with 
each other, as hackers may target the same types of companies and 
infrastructure. Additionally, society must grow the pool of cybersecurity 
professionals. According to a 2015 analysis by the Bureau of Labor Statistics, 
there are more than 200,000 cybersecurity jobs unfilled, the demand is expected 
to increase to a 1.5 million shortage of these professionals by 2020. 

Security for commercial aviation now means not only protecting people and 
property but also safeguarding information and data against unauthorized 
persons and systems. As we move into the future of flight, we must consider a 
new Set of questions to ensure safety and security objectives are being met. We 
will begin to see discourse shift to discuss the following topics: 


e Who can access the system? 

e How can the system be accessed? 
e What can be attacked? 

e What needs to be protected? 


ASRS EXAMPLES 


There are several measures put in place by airlines to protect the security of 
passengers. Below are a few examples from the Aviation Safety Reporting 
System that demonstrate aviation professionals’ tenacity in maintaining security 
through their adherence to company policies. The first report is from a pilot who 
is reporting a problem with boarding. The second report is from a cabin 
crewmember reporting on a passenger screening breach. 


SECURITY PROCEDURES 


Title: Compromised security resulting from procedural deviations. 


During the initial boarding process, I heard my Flight Attendant trying to keep passengers off of the 
airplane until a bag was removed from outside the aircraft (we had coordinated with the gate agents 
ahead of time to have the passengers sent out 25 minutes prior to departure per standard policy). 
However, during the boarding process, we noticed a checked bag sitting forward of the wing on the 
green gate-checked bag cart now with the other passengers’ bags. The passengers were dropping their 
green gate—checked bags off alongside this white checked bag (all on the same cart). After hearing my 
Flight Attendant, I immediately left the flight deck and stopped the passengers from boarding the plane. I 
had the passengers already on the plane deplaned and sent back inside. I advised Operations we had a 
white checked bag in the same proximity as passengers and that we needed to perform a full security 
search of the aircraft (which my crew performed and documented). I contacted Dispatch who contacted 
Ops. Ops sent out a GSC [Ground Security Coordinator] to ask why we were delaying the flight. After all 
of the coordination and security search, we were allowed to continue the flight. 


A checked bag should never be placed around passengers. We were repeatedly told over and over again 
by the rampers (and the GSC) that placing white checked bags in front of the wing is commonplace when 
a baggage cart is not around. We were then chastised for delaying the flight and were told that “This is 
how we do things over at the X and Y terminals. We always put white tags on bags at the gate.” I had a 
VERY difficult time convincing the GSC that this bag did NOT come from a passenger at the gate (it was 
a checked bag, not a gate-checked bag that was white-tagged). My Flight Attendant tried to explain our 
Company security policies to the GSC, but the GSC was again saying this is how they did things at “X 
and Y.” We had a very difficult time communicating with the ground personnel who were convinced they 
were doing everything right. 


The station rampers NEED to know security procedures so that the flight crew can be on the same page 
as the rampers. The focus is on on-time performance way too much, this time at the risk of security. After 
coordinating with Dispatch and Ops, we were told that the bag was from a connecting flight and not 
placed on the concrete so that it didn’t get wet. Unfortunately, we had numerous bags that were in fact 
placed on the concrete behind the wing, so that was a poor excuse. What is more, I took a picture of the 
very dry concrete immediately after being told this. If a baggage cart needs to be present so this does not 
take place in the future, then get a baggage cart. If security procedures need to be taught to ground 
personnel, then teach security. If on-time performance needs to be secondary to security (as it should be), 
then teach safety first. What is more, after we completed our turn, I was contacted by Dispatch saying 
that we as the flight crew were now being blamed for the delayed flight. We were told that the ground 
personnel were now saying that the checked bag was removed from the cart before ANY passengers were 
boarded which is a bold lie. When I left the flight deck (with a few passengers already onboard), I went 
immediately to the white checked bag on the baggage cart and inquired about what it was and where it 
came from. So if honesty needs to be taught, then teach honesty. 


Questions for the reader: Please explain why the flight crew was so concerned 
about passengers possibly being able to access a checked bag. How did 
employee ethics impact this scenario and future scenarios? 


CABIN CREW 


Title: Security breach from early boarding of plane. 


Narrative 1: 


Yesterday at XA:58 was going thru security when a passenger behind me stated, “why were we late since 
they are boarding,” in which I replied impossible he must have mistaken us for the cancelled flight from 
the previous night and they sent the passengers to an unscheduled flight for XA:30 departure. I stated 
that he must have been slightly delayed since our flight has a XC:00 departure with an XB:00 sign in. 
When my crew and I arrived at the gate we noticed few people in gate area and many boarding our 
flight! We were in disbelief since it was not even XB:00 and boarding time was not till XB:15! When we 
approached the [gate] agents they were in shock and did not know how to respond to us. We told them 
that this was a huge security breach and refused to board until they deplaned all passengers and do 
another security sweep. They did as requested and we boarded, did our equipment check and were able 
to board and depart on time. 


Narrative 2: 


We arrived at the gate approximately XA:57 and [are] met by the Ground Manager informing us they 
allowed passengers to board without the entire flight crew (pilots and flight attendants). I was shocked 
and told her that was a serious breach of security. Our Lead Flight Attendant and the rest of the crew 
refused to step on board the plane till proper security procedure be corrected. We were looking for the 
Captain, not aware he boarded the plane. After a few minutes the Captain deplaned and came back to the 
gate where he basically wanted us to go ahead and continue the rest of the boarding process. He said 
majority of the passengers are already on board and he wanted us to continue. I told him I did not want 
to violate security procedure with another violation because he said so. We tried to explain to him we 
also need few minutes to check our emergency equipment and other security procedure. Moreover we are 
not sure those passengers that boarded had been security cleared. Our Lead FA and the other 2 FAs 
explained to Captain as well to please do it right. We told him we need to deplane everybody and do 
another security sweep. If we do it right immediately we can manage to board all and still leave on time. 
At the end it was corrected and security sweep was accomplished after deplaning all the passengers. I 
honestly have no idea why it happened. This was my first experience of a security violation in my many 
years of flying. Gate agents and ground crew need to be retrained on security procedures. Most 
importantly Captain must be on top of these and have it corrected as soon as possible instead of 
persuading flight attendants to continue a serious security violation that can easily be corrected in the 
first place. 


Narrative 3: 


When crew arrived airport personnel had already begun boarding flight when there were no crew 
members onboard the airplane. As a matter of fact, they began boarding before we were even on airport 


property. 


Question for the reader: Please discuss why do you think all three flight 
attendants submitted reports for this incident instead of just relying on one flight 
attendant to report the situation on behalf of all of the cabin crew. 


CONCLUSION 


Figure 13-11 shows the large area consumed by the passenger screening area for 
one of the terminals at Barcelona International Airport in Spain. The enormous 
costs incurred to implement modern security technology illustrates the acute 


nature of the threat facing commercial aviation operations. High-technology 
detection methods can yield results, but it is clear that these results are expensive 
and are not perfect. Often, a small increase in security is achieved at very great 
expense. Furthermore, the cost is not just one of capital asset acquisition. There 
is also the matter of operations and maintenance. 


FIGURE 13-11 Passenger screening area for Barcelona’s Terminal T1. (Source: Wikimedia Commons) 


Although technology has its place in the overall security scheme, it is no 
panacea for air transportation security concerns. On the personnel side, greater 
attention needs to be paid to security staff recruitment, training, and procedures. 
Security professionals play a critical role and are the ones who interpret the 
results of the technological analyses. The technology itself needs to be designed 
from the start with cybersecurity in mind, and upgrades need to be continuously 
performed to guard against the latest types of cyberattacks. 

Until the TSA was established and took over security screening, many 
security personnel were low-paid workers who lacked the required training. The 
profession was plagued by questions of morale, turnover, stress, and 
ineffectiveness. The FAA insiders had criticized security personnel as being 
inadequate. The ATA responded by developing standards that called for better 
selection, improved work conditions, and rewards for effective security 
personnel. In addition, many airlines upgraded their personnel screening 
processes. Nevertheless, despite new training requirements, the process 
remained uneven. The length of training was too short, and the required contents 
to be covered were loosely defined. When the TSA took over this function in 


2001, conditions improved for security personnel in terms of pay, training, and 
other benefits. This has led to improved levels of security at airports. 

Another consistent problem through the years has been the screening of 
airport workers. Airports are like cities in that they require employees to work a 
large variety of vocations ranging from salespeople to mechanics to cleaners. 
Because this diversity of workers provides terrorists with numerous 
opportunities for infiltrating airport security zones, the FAA requires background 
checks, the review of previous employment records, and the wearing of special 
identification badges. Despite these efforts, these measures do not guarantee 
security. Terrorists can forge badges, although forging computerized badges is a 
far more difficult task, requiring insider collaboration or access to the 
computerized database and badge process. With the landscape of aviation 
technology changing, terrorists now have a new opportunity to exploit 
weaknesses and loopholes in the system. Instead of targeting airports and 
property, they can interfere with software and communication from remote 
locations. 

In addition, a technology solution alone suffers from problems defined by two 
related axioms. The first is that airport security is very site-specific. The thought 
being that what works well and inexpensively in one place is not necessarily a 
sound approach in some other place. The second axiom is political: regulators 
seldom recognize the real-world needs of security. No matter how well 
conceived a security regulation may be, it is not likely to have anticipated the 
kinds of problems that may actually arise. 

An important concluding point is that, in spite of all that have been 
accomplished to ensure the security of the traveling public, the terrorist, in one 
sense, always has the upper hand. While we must protect every element of the 
transportation system at all times (not just aviation), the terrorist always has the 
advantage of being the only one who knows the time, the place, and the method 
of the next attack. Stay vigilant! 


KEY TERMS 


Anti-hijacking or Air Transportation Security Act of 1974 
Aviation and Transportation Security Act of 2001 
Aviation Security Improvement Act of 1990 

Bag Matching 

Biometrics 

Checked Baggage Inspection Systems (CBIS) 


Cybersecurity 

Department of Homeland Security (DHS) 

Explosive Detection Systems (EDSs) 

Explosive Trace Detection Technology 

Hardened Unit Load Device (HULD) 

ICAO Security Manual (Doc 8973) 

Intelligence Reform and Terrorism Prevention Act of 2004 (IRTPA) 
International Civil Aviation Organization (ICAO) Annex 17 

Metal Detectors 

Millimeter-Wave Scanners 

National Counterterrorism Center (NCTC) 

Security Management System (SeMS) 

Security versus Safety 

The 9-11 Commission 

The Air Marshal Program 

The Homeland Security Act 

Transportation Security Administration (TSA) 

White House Commission on Aviation Safety and Security (the Gore 
Commission) 

X-ray Imaging 


REVIEW QUESTIONS 


1. What is the difference between security and safety? 
2. Provide three examples of different categories of attacks on civil aviation. 


3. Describe the international response to terrorism by ICAO and the world 
community. 


4. What is the Air Marshal Program and why was it instituted? 
5. Discuss the hijacking era. When did it end? 


6. What was the biggest security lesson learned from the Pan Am Flight 103 
tragedy? 

7. Use an example to explain the concept of redundant technical measures in 
security. 


8. Discuss the role and functions of the Transportation Security Administration 
(TSA). 


9. What was the reason for the 9-11 Commission? What impact did its 
recommendations have on the U.S. intelligence community? 


10. Explain the operation of the National Counterterrorism Center (NCTC). 


11. Discuss some of the problems encountered in the gathering and analysis of 
intelligence for security purposes. 

12. Give an example of four different security devices used to prevent weapons 
and explosives from entering an aircraft and explain the workings of these 
devices. 
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LEARNING OBJECTIVES 


After completing this chapter, you should be able to 


e Depict the general areas presenting challenges and opportunities to 
commercial aviation safety in the 21st century. 


e Discuss the need to modernize air traffic services and technology in order to 
reduce accident rates and increase efficiency. 


e Provide examples of unresolved and emerging problems facing the 
commercial aviation sector that threaten to impact aviation safety in the first 
half of the 21st century. 


e Explain several technological areas requiring attention by aircraft designers to 
reduce accidents and serious incidents in the 21st century. 


e Describe the difficulties associated with ensuring that key flight crews are 
healthy psychologically. 


e List some of the emerging challenges faced by practitioners and researchers of 
Safety Management Systems. 


INTRODUCTION 


This chapter explores the expected major challenges facing the commercial 
aviation industry in the first half of the 21st century, as detected through new 
factors present in accidents, serious incidents, and proposed by academic 
researchers. Several of the previously covered areas in the book will continue 
receiving significant attention by aviation professionals because many risks have 
not been eliminated and must be continuously managed going into the future. 
The new concepts exposed in this chapter are not meant to be an exhaustive 
coverage of emerging safety areas, and as the years pass, new areas of attention 
will surely emerge. That is the nature of safety. As the Nobel Prize—winning 
Danish atomic physicist, Niels Bohr, once humorously quipped, “Prediction is 
very difficult, especially of the future.” Nevertheless, the areas covered provide 
an overview of different conditions that are receiving increased attention bv 


aviation safety professionals at the time of this book’s printing. o 
AIR TRAFFIC MANAGEMENT 


There is a relatively well-known quote, sometimes attributed to the American 
author Mark Twain that says, “Buy land, they’re not making any more.” A 
similar sentiment can apply to airspace since we do not have the ability to make 
more area in which to fit aircraft. What we can do is use what we have more 
efficiently. There are increased demands to integrate new types of vehicles into 
the airspace that has mostly been used by traditional commercial and private 
aircraft. 

The significant increases in commercial air travel strain the planet’s airspace, 
especially when coupled with the explosive growth of unmanned aircraft 
systems (aka “drones”). The airspace will face further strain in future years as 
new suborbital space flight vehicles start ascending and descending through the 
lower atmosphere in a short amount of time. When we venture away from 
airports and, particularly, out over large bodies of water that often lack radar 
coverage, the challenge is not as much traffic congestion as it is tracking flights. 
When flights go missing it can take years to find the aircraft that have 
experienced an accident, if we find the missing aircraft at all. 


AIRSPACE UTILIZATION 


Much of the globe increasingly faces a daunting aviation safety challenge as the 
century develops. The seemingly incessant increase in the demand for air 
transportation will mean that more and more aircraft will fill the skies. 
Simultaneously, the traveling public is growing more demanding of safety. The 
overriding challenge is therefore how to simultaneously enhance airspace 
capacity, particularly in the airport areas, while decreasing the commercial 
aviation accident rate. 

Currently, most U.S. airspace is managed by air traffic controllers who use 
radar as a key tool for managing aircraft flow. The radar sweeps the area it 
covers with a radio wave and recognizes flying objects. Typically, it takes a 
radar dish 12 seconds to rotate. Even though it is a reliable method, it is 
expensive and does not give information in real time since controllers must wait 
12 seconds for the position updates. To cope with the time gap for new 
information, controllers keep wider separation between aircraft. This decreases 
the capacity of the airspace. The aviation industry and the governments of many 
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sky. 

New operational procedures and technology have been introduced 
systematically and slowly. Safety is a critical concern of the industry, so the 
challenge must be approached with caution. Proposed changes undergo serious 
consideration and testing prior to being implemented. The field is very 
innovative, but often the technological advancements in the aircraft have 
outpaced those for air traffic control. In some cases, planes built during the 21st 
century are using routes with radar stations from the 1940s and 1950s. 

For the traffic growth to continue safely, the air traffic management system 
must also undergo changes. This includes changing the system so that it centers 
on the performance of flight itself. Controllers would manage the airspace to 
provide optimal use rather than control the route of each flight. The benefit is 
that controllers would be able to handle more aircraft at any one time while 
reducing delays and improving safety. 

North America remains the busiest region in the world for air traffic. The 
Federal Aviation Administration (FAA) is the body that governs how the United 
States will implement new policies and technologies for increasing the safety of 
airspace utilization. The FAA aims to incorporate technologies that will make air 
transportation more safe and efficient. Some of these include NextGen programs 
such as satellite surveillance, required navigation performance (RNP), and the 
Automatic Dependent Surveillance—Broadcast (ADS-B) system. 

NextGen is the United States’ new national airspace system set to be in place 
by 2025. It aims to transform the air traffic control system from a radar-based 
system to a satellite-based one with GPS. The program’s priorities include 
multiple runway operations, nonvoice data communication, performance-based 
navigation, surface operations, and data sharing. One aspect all of these priorities 
have in common is that ultimately they will make the ground and the airspace 
safer places. 

Satellite surveillance is technology that has recently emerged to help support 
air traffic navigation. With greater visibility of what is going on in the sky at all 
times, air traffic controllers can utilize more of the available airspace for 
operations. Aircraft can also fly closer together, which increases capacity 
significantly without affecting safety. Further reductions in spacing may be 
obtained through more accurate modeling and detection of wake turbulence, 
among other factors. 

Required navigation performance is a concept that stems from satellite 
surveillance and is helping improve the safety of airspace utilization. It allows 
planes to fly precise routes without having to rely on ground-based radio- 


navigational signals. One advantage is that RNP allows pilots to land in 
hazardous weather conditions that might otherwise require holding, diversion, or 
even cancellations. Its precision and reliability ultimately can help air traffic 
controllers to minimize delayed flights and reduce traffic congestion (Fi 


). 


FIGURE 14-1 Sample NextGen cockpit display function under development by NASA that allows pilots to 
self-regulate spacing from other traffic during arrival at an airport. (Source: Authors) 


Another flexible airspace and flight operations tool that will help improve 
safety in the skies is ADS-B. It pairs the satellite navigation system with a 
network of receivers that are on the ground. The result is enhanced oversight of 
aircraft position in the sky, an advantage over radar, which only locates an 
aircraft when it sweeps the area within its range. By using ADS-B, air traffic 
controllers can reduce aircraft separation, allowing for more efficient routes and 
increased airspace capacity. 


UNMANNED AIRCRAFT SYSTEMS (UAS) 


In addition to expected increases in traditional commercial air traffic, worldwide 
airspace is under growing pressure by a new type of user. An unmanned aircraft 
system (UAS), sometimes called a “drone” by the public, is an aircraft without a 
human pilot onboard—instead, the UAS is controlled by an operator on the 
ground. The growth of UAS has exploded as users purchase them for 
commercial and recreational purposes. Other terms used to describe these 
vehicles include unmanned aerial vehicles (UAV) or remotely piloted aircraft 
(RPA). As they become more common in the sky, UAS are proving to threaten 
the safety of traditional aircraft operating in the airspace. Chapter 10 contains 
further information on this airspace threat, and the reader is encouraged to 
consult the Internet for the latest information in this rapidly changing area (see 
www.faa.gov/UAS/). 

Although there has yet to be a confirmed midair collision between a UAS and 
a piloted aircraft in the United States, it is just a matter of time until it occurs. 
Outside of the United States, the French government agency in charge of 
accident investigation, the Bureau d’Enquétes et d’ Analyses, reported that on 
February 19, 2016 a UAS came within 16 feet of impacting an Air France A320 
carrying 150 people which was arriving in Paris from Barcelona. The pilot had 
to disconnect the autopilot and take evasive action to prevent the collision. 
Furthermore, actual collisions have already occurred in other countries. Many 
close calls have been near airports. In a number of these cases, the event 
happened within 5 miles of an airport and at altitudes higher than 400 feet, 
meaning that UAS obviously can operate far into the airspace that is regularly 
used by commercial aircraft. 

Several challenges are presented when trying to prevent such a hazard. Many 
of the operators of small UAS have no aviation background and are oblivious to 
the legal requirements for operating in controlled airspace. It proves very 
challenging even locating the operators, who could be just about anyone in a 
private residence operating a small UAS out of their backyard. 

The damage a UAS can cause to an aircraft can be quite significant. Both 
academia and industry have started to research the impacts a collision between 
the two types of aircraft may have. Currently, aircraft engine manufacturers test 
their designs against bird strikes but have not taken UAS into consideration. 
Recent published studies show that a UAS encounter could cause critical 
damage, including breaking the glass of a cockpit, fracturing helicopter blades, 
and destroying jet engines. UAS come in varying shapes and sizes. Figure 14-2 
shows what most of the general public associate with UAS, but Figure 14-3 


serves to caution us that some vehicles can actually be imposingly large. 


FIGURE 14-2 A seemingly innocent UAS poses a serious midair collision threat. (Source: NOAA) 


FIGURE 14-3 Although many think of them as small toys, UAS come in all shapes and sizes. (Source: 
USAF) 


To prevent such mishaps and advise the public about UAS safety, the FAA 
and industry groups have launched an education campaign titled Know Before 
You Fly. Since UAS can jeopardize airspace safety in some situations, the FAA 
has deemed certain places as no drone zones without prior authorization. These 
areas include, for example, airport control zones, U.S. military bases, U.S. 
national parks, and near the White House in Washington, D.C. To learn more 
about FAA current UAS regulations, please refer to FAR Part 107 and the FAA 
Web site. 


COMMERCIAL SPACE VEHICLES 


Space tourism used to be a dream of many. However, every day we get closer 
and closer to making the dream a reality through the commercial space flight 
industry. In addition to space tourism, aerospace companies are developing 
vehicles designed for suborbital spaceflight to perform science missions that 
studv the atmasnhere. astranomv. and glohal climate change. In same cases. the 
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spacecraft are designed to depart from and arrive at commercial airfields in the 
same way that traditional aircraft use runways. 

The vehicles may feature rocket-powered climbs up to 350,000 feet that result 
in extremely high rates of climb through all the levels of the airspace and then 
descend back minutes later after reaching their peak altitude. With such an 
operation, though, comes the challenge of safely integrating such unusual air 
vehicles into the air traffic control system. An increase in space operations 
combined with continued growth in air traffic operations could place a huge 
demand on the airspace system and air traffic control. Figure 14-4 depicts the 
simulator for a suborbital space flight vehicle, showing a mission specialist in a 
pressure suit preparing for takeoff to perform a mesospheric imaging science 
mission. 


FIGURE 14-4 A mission specialist in a suborbital space flight simulator prepares for a science flight from 
a commercial airport. (Source: Authors) 


The U.S. space program today includes three sectors: civil, military, and 
commercial. The Office of Commercial Space Transportation (AST) is the 
division of the FAA whose mission is to ensure the protection of the public, 
property, and national security during commercial launch and reentry activities. 
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transportation. 

To accommodate the addition of commercial space traffic into the national 
airspace, the FAA has developed a concept of operations called Space and Air 
Traffic Management System (SATMS). It will play a pivotal role in providing 
safe access to all users of the airspace. This aims to seamlessly integrate space 
vehicles traveling to and from space by developing new space and air traffic 
management tools. Together, these tools will provide enhanced communications, 
navigation, and surveillance (CNS) services. A major goal will be to generate 
methods and procedures to reduce the amount of airspace that is restricted for 
each launch and the amount of time that space will be needed. In turn, this would 
accommodate regular air traffic without disrupting the space mission and 
compromising safety. 

A part of the SATMS is the decision support tool (DST). The tool is a 
software and computing system the FAA is currently designing to facilitate air 
traffic controllers’? management of airspace restrictions and to reduce risks to 
aircraft from space operations. The tool would have two modes: planning and 
real time. In the planning mode, the DST would identify the airspace restriction 
requirements, potential impacts on other airspace users, and options alleviating 
those impacts. The real-time mode would show the space vehicle’s route and 
help air traffic controllers to maintain a safe separation if emergencies occur. 
Ultimately, the SATMS DST would allow decision makers to make informed 
choices for reducing collision risks in the airspace. 

Challenges currently exist that prevent the SATMS DST from being fully 
integrated. One obstacle is validation. Extensive verification testing will be 
mandatory throughout each phase of design and deployment. Second, the DST 
must be flexible enough to receive data from many types of vehicles and 
operators and to provide output information for other parties such as the airlines, 
military, NASA, and future spaceport and range operators. 

Each space mission will have a set of unique requirements that will shape the 
airspace integration process. As a result, it will require its own strategy. 
Currently, there is a list of airspace management strategies that include the 
following: 


e Minimizing the duration of the launch and reentry operation’s window 
e Moving the operating window away from peak traffic times 


e Altering the launch or reentry trajectory to avoid placing airspace restrictions 
in congested airspace 


e Negotiating special use airspace so that reserved airspace can be used during 
the operation to reduce reroute mileage of affected aircraft 


One obvious risk of operating traditional aircraft in the same airspace as the 
comparatively much faster space vehicles is collision. Space vehicles are 
expected to pass through the vertical layers of airspace quite quickly as they 
climb to space where payloads can be employed, science samples collected, and 
tourists awed. Such vehicles could potentially climb through the upper bound of 
the national airspace system, which is 60,000 feet, in 2 to 3 minutes. Therefore, 
these operations would be confined to a small region of airspace for a short 
period of time. One option is the use of space transition corridors (STCs) to 
safely separate traffic. STCs would be designated airspace areas that would be 
issued and withdrawn as necessary to maximize safety while minimizing the 
impact to air traffic. An STC would remain in place shortly prior to the flight 
and removed once the mission had been completed. During the flight, air traffic 
control would watch the space for weather and traffic conditions and remain on 
guard for responding to an accident that could affect the safety of the area. 
Figure 14-5 shows a potential standard profile for certain types of suborbital 
space flight vehicles, which may ascend to space and descend for landing at a 
single operating location all in less than 30 minutes. 
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FIGURE 14-5 This profile shows a future suborbital space flight from a conventional airfield. New 
vehicles will climb quickly into space and then return in less than 30 minutes. (Source: Authors) 


Although STCs may greatly reduce the risk of a midair collision between 
space vehicles and conventional aircraft, STCs may prove highly inefficient if 
spacecraft traffic increases. There are hopes that the commercial spaceflight 
industry will grow rapidly and also a strong possibility that vehicles will use the 


same airspace as traditional commercial aircraft. Some plans call for commercial 
snacecraft ta anerate ant af canventional airfields several times a dav ner 
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vehicle. If several such vehicles operate with such high frequencies from the 
same airfield, it is conceivable that there could be dozens of fast climbs and 
descents through the airspace overlying an airfield in a single day. Reserving 
such airspace exclusively for space vehicles could potentially paralyze 
commercial aviation traffic in the area, so innovative technology and procedures 
will have to be developed to integrate the spacecraft with the aircraft. Research 
is currently underway to determine the feasibility of using newly developed 
technology onboard suborbital space vehicles to allow their pilots to provide 
their own separation from traditional commercial aircraft, possibly by relying on 
ADS-B and traffic deconfliction algorithms. 

Hazards could also arise if commercial spacecraft experience catastrophic 
inflight breakups that spray underlying areas with falling debris. For example, 
the Space Shuttle Columbia in 2003 broke apart during reentry, producing a 
large cloud of falling debris, much of which could have severely damaged or 
destroyed an aircraft on impact. Models have shown that a piece of a space 
vehicle debris less than one pound in weight could puncture the wing or cabin of 
aircraft cruising underneath. Figure 14-6 depicts one of the major pieces of a 
Virgin Galactic suborbital space vehicle that came apart in the air and crashed to 
the ground in California in 2014, killing the copilot and severely injuring the 
pilot. 


FIGURE 14-6 The NTSB investigates the fatal Virgin Galactic Spaceship II accident. (Source: NTSB) 


OCEANIC 'TRACKING 


The flying public often observes how unimaginable it is that in the 21st century 
we still lose commercial aircraft in the middle of a flight during overseas 
journeys. In fact, it is something that the aviation community has dealt with 
since the first transoceanic flight. In 2009 Air France Flight 447, an Airbus 330, 
disappeared over the Atlantic Ocean, and it took considerable time to find parts 
of the wreckage. | 4-7 shows recovery crews working with a large piece 
of wreckage in the ocean. The passenger flight was operating from Rio de 
Janeiro to Paris. All 228 occupants of the aircraft perished. 


FIGURE 14-7 Recovery operations for the wreckage of Air France Flight 447. A surface and aerial search 
was launched until wreckage was spotted by the Brazilian Air Force in the Atlantic Ocean. (Source: Bureau 
d’Enquétes et d’Analyses) 


In 2014, Indonesia AirAsia Flight 8501, an Airbus 320, went missing over the 
Java Sea for a period of time and was found to have crashed, killing all 155 
passengers and 7 crew on board. Also in 2014, Malaysia Flight 370, a Boeing 
777, disappeared and could not be found to date. All 227 passengers and 12 
crewmembers were presumed dead. Currently, the aviation community is 
considering short-term and long-term steps to improve aircraft tracking in non- 
radar areas. 


Although many commercial airline passengers probably expect that their 
flight is being tracked on radar by air traffic control, significant amounts of 
airspace remain out of radar coverage. In areas such as the North Pole and South 
Pole, oceanic airspace, and parts of Africa, Asia, and South America, pilots must 
use radio or satellite communications to update their location to air traffic 
control. ICAO requires that, at minimum, aircraft have a working two-way radio 
to communicate with air traffic control. As per FAA recommendations for 
oceanic and international operations, pilots are to report their position to the 
appropriate air navigation service provider for that region before entering a new 
flight information region. Pilots should report their position after the first 30 
minutes of flight and at required intervals thereafter if the route does not have 
designated reporting points. 

The oceanic airspace presents surveillance limitations that make it hard to 
pinpoint the exact location of an aircraft in an emergency. Radar keeps track of 
aircraft position in real time, but coverage begins to lessen more than 150 miles 
from the coast and in remote airspaces. Since there is not a constant update of an 
aircraft’s location in those areas without radar coverage, pilots are to report their 
position. Updating one’s position can be problematic. If there are disruptions 
from weather and atmospheric conditions over the ocean, it may take a flight 
crew 10 to 20 minutes to relay their position using radio. This could pose a 
serious situation in the event of an emergency when changes in altitude or course 
are required in proximity to other aircraft. Figure 14-8 illustrates just a small 
portion of global oceanic traffic through depictions of flight tracks. 


FIGURE 14-8 Despite being over remote places such as oceans, these tracks show that there is still a 
significant amount of air traffic. (Source: FAA) 


Another challenge posing a threat to safety in oceanic traffic monitoring is the 
difficulty of communication and coordination between air traffic control centers. 
International air traffic control is divided geographically based on flight 
information regions. This problem was highlighted by the accident of Air France 
Flight 447. There was a lack of communication between the controllers about the 
projected passage of the plane from one airspace to another. 

The disappearance of Malaysia Airlines Flight 370 in the Indian Ocean is the 
most recent event that has pulled the international aviation community together 
to improve aircraft tracking. Professionals would like to see position reporting 
decreased to 15-minute intervals, with the ability to increase communication in 
the event of an emergency. Such capabilities should allow the regular and 
automatic transmission of aircraft position information. Currently, commercial 
airline operators are responsible for aircraft tracking. The 15-minute frequency is 


the best compromise between the desire to know an aircraft’s precise location 
and the cost of transmitting data. 

When an aircraft does disappear, investigators search for data that can show 
them the last position of the aircraft and what happened. The current, crash- 
resistant flight and data recorders possess such data but must first be located in 
order to retrieve the data. The future may bring the requirement for aircraft to 
transmit certain data to ground stations in real time so that investigators can 
quickly narrow the area of search for wreckage and also hone in on factors that 
potentially contributed to the event. However, modern aircraft create a large 
amount of recordable data and technical solutions are required in order to 
transmit the data in real time to ground stations. 

For example, an article in the March 2013 issue of Computerworld UK states 
that Virgin Atlantic expects to receive half a terabyte of data from each Boeing 
787 per flight, whereas only 4 years ago, all the commercial airlines combined 
generated 11 terabytes of data for the entire year. One terabyte equals a trillion 
bytes of data. The growth in the amount of data available for transmission is 
increasing at an alarming rate and creating transmission systems that span long 
distances with the bandwidths to accommodate large amounts of data streaming 
from tens of thousands of aircraft simultaneously may prove expensive. 
Transmitting only position data would reduce the bandwidth requirements and 
would assist in locating the wreckage if an accident has occurred, but it would 
prove to be of little value to accident investigators. 

Another proposal from the community was to change communication 
standards between air traffic service providers and airlines to improve 
coordination if there is an emergency. Such changes would create protocols and 
standards to improve the response to instances of missing position reports or 
other dangerous situations. Additionally, aviators have suggested that position 
reports should always include latitude, longitude, altitude, and time information 
because having this information allows for more precise positions. 

Several technologies exist that could help achieve enhanced tracking. One is 
the Aircraft Communications Addressing and Reporting System (ACARS), which 
provides digital datalink for transmission of short messages via air band radio or 
satellite between ground stations and aircraft. It has the capacity for enhanced 
reporting if the system is triggered by an unanticipated altitude change or a flight 
level below a specific altitude. A second viable option is the Future Air 
Navigation System (FANS), an avionics system that provides a direct data link 
communication between air traffic controllers and pilots. Information includes 
clearances, pilot requests, and positioning reports. The airline ground system can 
access pertinent information about the position of the aircraft using special 


applications. 

Despite having technologies that could enhance the safety of oceanic 
tracking, there are still some obstacles associated with them. One major concern 
with ACARS and FANS is that they are not tamper-proof. Consequently, anyone 
with knowledge about the technologies could disable both systems and the 
aircraft’s transponder. Without these systems, it is not possible for the aircraft to 
send position data. Another hurdle is cost. To equip a single aircraft with 
ACARS could cost up to $100,000. Similarly, adding FANS would result in an 
additional cost of $250,000. These are not small amounts, particularly for 
operators of large fleets of aircraft where costs rapidly add up to multimillion 
dollar expenses. 

Tracking extends beyond just airplanes in flight. Another issue to discuss is 
the location of plane wreckage if it does crash into the ocean. The wreckage and 
flight data recorder are essential items to have for the accident investigation. As 
a result, the safety community is taking measures to make sure that these items 
can be located whenever there is an accident. Ocean currents can move aircraft 
wreckage from its initial point of impact. Aviation professionals are looking at 
extending battery life on underwater locator beacons that are attached to flight 
recorders. Also, the industry has discussed including a second beacon that has a 
greater transmission range. 

International Civil Aviation Organization has developed the Global 
Aeronautical Distress and Safety System (GADSS) to work on the above matters. 
This system addresses the concern of locating an aircraft’s position both during 
and after the accident sequence. GADSS consists of four key components. First, 
it aims to improve the aircraft tracking system by increasing position reports 
when abnormalities are detected. Second, GADSS wants to incorporate an 
autonomous distress tracking system that would act independently from the 
regular aircraft tracking system. Unusual attitude, speed, acceleration, or failure 
would trigger an alert. Third, there would be an automatic, deployable flight 
recorder. The flight recorder would separate automatically from the aircraft in 
the event of an accident. Fourth, there would be an improvement in procedures 
and management of information. Other future changes include improved 
coordination and information sharing and enhanced training of emergency 
teams. 


SURFACE TO AIR MISSILES 


Terrorists have long understood the importance of air travel in today’s society, 
and as a result, made it one of their prime targets. In 2001 the terrorist 


organization al-Qaeda declared the incapacitation of the U.S. economy as their 
primary goal. 

That same year, the 9-11 terrorist attacks used the airline industry as a tool for 
wreaking both terror and economic mayhem. Fast forward to today, and another 
very present threat to commercial aviation safety is surface to air missiles 
(SAMs). Typically used for war, the missiles are launched from ground vehicles 
or shoulder-mounted units to destroy aircraft or other missiles. The threat itself 
is not new. In 1970, an Alitalia DC-8 was hit by a SAM near Damascus, Syria. 

There have been more recent incidents in which commercial planes have been 
targeted, shot at, and even hit by SAMs. In 2002, an Arkia Israel Boeing 757 
flying near Mombasa, Kenya, narrowly averted being hit by two SAMs. In 2014, 
another commercial airliner was hit by a SAM but faired much worse. The 
aircraft was a Boeing 777 operating as Malaysia Airlines Flight 17 (MH 17). The 
aircraft was on a scheduled flight from Amsterdam to Kuala Lumpur. While 
crossing over the Ukraine-Russian border, militants mistakenly shot down the 
plane, killing all 283 passengers and 15 crewmembers on board. Figures 14-9 
through 14-11 depict the tragic sequence of events that downed the jet. 


s = —— Te -= 
REG Ss = 


FIGURE 14-9 An image captured from an animation showing the launch of the SAM that shot down MH 
17. (Source: Dutch Safety Board) 


FIGURE 14-10 An image captured from an animation showing how the captain of MH 17 may have seen 
the SAM instants before it exploded just outside of the flight deck window. (Source: Dutch Safety Board) 
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FIGURE 14-11 An image captured from an animation showing the explosion of the SAM that shot down 
MH 17. (Source: Dutch Safety Board) 


Unfortunately, commercial planes are quite vulnerable to SAMs. Such aircraft 
have takeoff and landing patterns that are predictable, unlike military aircraft 
that can vary such patterns to make it harder for terrorists to set up a missile 
launch to intercept their target. Second, some missiles have heat-seeking or 
radar-guiding capabilities. Furthermore, some combat aircraft have the ability to 
launch flares that are designed to confuse the SAM’s guidance system by 
sending out waves of heat over a wide area or have chaff or jammers that 
confuse radar units. 

Commercial passenger airplanes have several components that produce 
significant heat signatures, large radar signatures, and do not possess flare, chaff, 
or jamming systems, thus making them particularly susceptible to SAMs. 
However, laser jammers are an emerging technology that could provide 
substantial protection against missiles. They work by overwhelming the signal 
produced by the missile and then substitute a special signal transmitted by the 
laser in an effort to divert the missile. This would allow for the diversion of a 
single attack. At least one commercial airline already uses jammers to mitigate 
the SAM threat, although such use is by no means widespread. Other viable 
defensive options exist but they are not best suited for commercial airline use. 

When such technologies are not used, the best way by which commercial 
flight crews can avoid getting hit by SAMs is to avoid potentially dangerous 
areas in the first place. The FAA publishes information about no fly zones 
through Notices to Airmen (NOTAMs), which place restrictions on commercial 
flights operated by U.S. airlines. The geopolitical situation of a region can 
greatly influence the FAA’s decision to add a region to the forbidden list. There 
are two levels of warning. A Red Zone typically prohibits flight at any level of 
altitude, while a Yellow Zone denotes areas that pilots should exercise caution 
when flying over. Figure 14-12 shows areas of risk from SAMs during 
overflights on long-duration trips out of London. 


IS YOUR FLIGHT CROSSING A TERRORIST DANGER ZONE? 
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FIGURE 14-12 In 2015, the FAA produced this depiction of current flight profiles out of London that 
would be vulnerable to a surface to air missile attack. (Source: FAA) 


In the aftermath of the MH 17 shoot-down, ICAO stated that countries have 
the responsibility to alert others of any potential risks to civil aviation operations 
in their airspace. However, some leaders argue that countries could jeopardize 
national security and intelligence gathering activities if they share that 
information. Moving forward, governments must work together to create 
channels to make critical threat information available to international civil 
aviation authorities. 


Countering the proliferation of missiles is a top security priority for the 
United States, among other reasons, because SAMs pose a serious threat to the 
commercial aviation industry. Policy changes could potentially combat the threat 
of SAMs. The United States can fight against missiles becoming widely 
available in the international weapons marketplace through buyback programs 
and technology control. Many existing missiles that are in the wrong hands are 
old and obsolete. While they may be ineffective against modern military aircraft, 
they can still pose a threat to civilian aircraft. 

One recommendation that the U.S. Department of Homeland Security has 
suggested to prepare pilots for handling missile threats is to increase pilot 
training, such as putting pilots through specific simulator exercises using missile 
attack situations. These scenarios would benefit pilots by preparing them to fly 
and land a damaged aircraft. A missile strike that does not cause a catastrophic 
structural failure would likely be survivable if the crew is adequately trained to 
handle such a situation. In fact, this did happen in Iraq to a DHL cargo flight in 
2003. Shortly after the Airbus 300’s departure, a SAM struck the plane’s left 
wing, causing a fire and loss of the hydraulic control system. The event occurred 
near Baghdad and the Airbus 300 managed to land, although severely damaged. 
Despite the damage, the pilots were still able to land the plane safely. 

There are measures that can be taken to improve airport security to protect 
commercial aviation from SAMs. An increase in security, surveillance, and 
patrols in the areas of airports with commercial aviation will only protect aircraft 
to an extent. Approach and departure corridors are still within the range of 
SAMs and stretch for several miles beyond airport property. Security forces 
would need to determine locations beyond the airport property that have a higher 
threat potential and where aircraft may be susceptible to attacks. Forces will then 
be able to patrol areas to counter threats to security. 

Currently, there is no single solution to ensure security in the sky from SAMs. 
Rather, a combination of defensive options is needed to guard against this 
serious threat. 


AIRCRAFT DESIGN 


AIRCRAFT ICING PREVENTION 


Aircraft deicing and anti-icing is a critical part of preventing frost, ice, or snow 

from building up on the wings of the plane. At first glance, it may not seem like 
this type of precipitation could affect flight, but in fact, it has a critical impact. It 
has been recognized as a significant safety hazard affecting the aviation industry 


today. That is why aviators take many safety measures to ensure that planes get 
cleaned of contaminants and stay clean when frozen precipitation occurs or 
conditions may lead to freezing of moisture on an aircraft. 

Although the hazard posed by such conditions is not new, the future of 
commercial aviation safety will likely feature ways to enhance the detection of 
contaminants and improve a stall detection system’s accuracy when airfoils are 
contaminated. Currently, there are no routinely used systems that automatically 
detect the presence of icing on lifting surfaces, such as aircraft wings and tails, 
during flight. Furthermore, current stall warning systems also do not take into 
account the disrupted airflows that occur during icing and can produce aircraft 
aerodynamic stalls well in advance of any warning. 

The contamination of the aerodynamic surfaces on an aircraft can prevent the 
generation of sufficient lift to sustain flight, can impede the movement of control 
surfaces, and can make the aircraft uncontrollable. Often the first time a pilot 
notices that contamination exists is during takeoff, when the aircraft is unable to 
lift off, or when the aircraft becomes airborne but is unable to climb out of 
ground effect. When contamination occurs unevenly, the aircraft may still be 
able to become airborne, but, as soon as the aircraft exits ground effect, an 
asymmetrical stall may develop which results in a wing dipping and contacting 
the runway. 

The threat of icing occurring during ground operations is particularly worthy 
of discussion because aircraft equipped with onboard anti-icing and deicing 
systems are often severely limited in operating such systems while the aircraft is 
on the ground. 

Future efforts to enhance safety with ground icing must stress to pilots that 
they should always perform a tactile contamination inspection of airfoils prior to 
flight. Contamination can be extremely hard to detect, particularly at night or 
during precipitation when inspections are rushed to get the plane out of the rain, 
snow, or sleet. Pilots should be taught to remove their glove when performing a 
tactile contamination inspection of the airfoil since a gloved hand is unable to 
detect the presence of small amounts of contamination. Such miniscule 
quantities can cause a significant aerodynamic problem. Yet another challenge is 
presented by the inaccessibility of airfoils on the empennage, or rear-most 
section of an aircraft, particularly for T-tail assemblies. Pilots must often rely on 
instinct, deduction, or trust in another observer to ensure that aircraft horizontal 
stabilizers are free of contamination when performing external inspections of 
aircraft before departure. 

Most airlines use a glycol—water mixture to remove ice during ground 
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to a gel, to keep the ice from forming before takeoff. Departure acceleration 
clears the fluid from the wings by breaking the chemical bonds that hold the 
fluid together, allowing no disruption to the aerodynamics needed for flight. 

An interesting technology scientists are exploring to address icing hazards 
and which may be developed in the future stems from poisonous frogs. In an 
article in a 2015 edition of Advanced Material Interfaces written by mechanical 
and aerospace engineering researchers at Arizona State University, this new 
technology was showcased as a means for aircraft wings to de-ice themselves by 
secreting antifreeze, similar to the way a dart frog’s skin secretes toxin when it is 
threatened. Two thin layers would be sprayed onto the wing of the plane. The 
outer, porous layer would protect the inner layer against outside elements while 
the inner layer would be infused with antifreeze. As the outer layer fails, the 
inner layer would release the antifreeze to prevent ice accumulation. The 
researchers tout that such a two-layer skin model can delay accumulation of 
some freezing precipitation up to 60 times longer than the next best material. 
This should not affect airflow over the wing, but instead, be a safe option to keep 
wings clean of ice and frost during flight. 

To understand the critical role that deicing plays in aviation, it is important to 
note that business analysts predict it will be a billion dollar market by 2020. 
With aviation projected to grow internationally, countries around the world are 
expected to witness a surge in demand for aircraft deicing systems. More 
vendors are entering the market with different technology and equipment for 
containment, collection, recycling/recovery, and treatment. 

Infrared systems are another emerging technology that airports are turning to 
for deicing. Planes can park in an open hangar where infrared radiation melts 
frost, snow, and ice, and minimum glycol is used. Advantages to this include 
lower fluid costs, being more environmentally friendly, and faster throughput. 
However, the technology has been slow to catch on because it is difficult to find 
the space to build the infrared structure since it is about 100 feet tall, and a 
structure that tall cannot be built too close to an active runway. 

Improved weather forecasting can also help airports with planning for deicing 
and anti-icing. Continuously updated forecasts help airport operators make 
decisions on deicing procedures. If more than necessary resources are used for 
deicing as a result of inaccurate forecasts, it is a waste of manpower and money. 
The National Center for Atmospheric Research together with the FAA 
developed the Weather Support to Deicing Decision Making (WSDDM) tool. 
Data comes from Doppler radars, surface weather stations, and snow gauges 
within the terminal area. The system then graphically depicts this information for 


airline station controls, dispatchers, deicing facilities, airline snow desks, and 
FAA air traffic managers to help make decisions about the appropriate measures 
to take care of the aircraft. 

Simulators have recently emerged that allow deicing personnel to train with 
icing conditions. The cost of deicing/anti-icing training is expensive and 
sometimes prevents new employees from getting adequate training before 
critical times. Simulators mimic video games in that they have controls that are 
exact replicas of the controls in the deicing equipment. Such simulations also 
allow employees to change the time of day, control the amount of precipitation, 
and adjust the weather to create different, challenging, and realistic scenarios. 

Although aircraft on the ground are particularly vulnerable to ice 
accumulation, the future of commercial aviation safety must also address the 
detection and removal of contamination once aircraft are in the air. To that end, 
the FAA recently tightened their standards for icing certification. The update 
requires U.S. manufactures to show that aircraft can operate safely in freezing 
drizzle, freezing rain, and conditions known as “super-cooled large drops” 
(SLD). These types of precipitation can severely degrade airplane performance 
and handling. The intent of the rule change is to ensure future fleets will be able 
to withstand unexpected encounters with icing conditions with more resiliency. 
Since 1996, the FAA has issued 112 rules to correct unsafe conditions in aircraft 
related to icing. Future research also includes the design of icing detection 
systems, especially for tail icing, which is a significant weak area in the fight 
against the icing hazard to aircraft. 


SOFTWARE SAFETY AND CYBERSECURITY 


The attention of aviation safety experts is frequently called to new areas, often in 
response to accidents attributed to conditions that were previously downplayed. 
Such hazards are sometimes referred to as “sleeping giants” since they describe 
conditions that do not receive the attention merited by the severity that they pose 
and which could one day produce a catastrophic event. In the 1970s and 1980s, 
such a sleeping giant was Controlled Flight into Terrain (CFIT). In the 1990s, 
another sleeping giant was wiring safety. Some experts point to a current 
sleeping giant as being software safety and security. A future area in commercial 
aviation safety may be expanding awareness of software failure modes and the 
vulnerabilities of software to intentional attack by terrorists. 

Software safety first caught the wide attention of the public following the 
1962 self-destruction of NASA’s Mariner 1 spacecraft, bound for Venus, 5 
minutes after launch when a coding error sent it off course. The problem was 


once more highlighted to the public during the 1999 loss of the NASA Mars 
Climate Orbiter. The orbiter was a 338 kilogram robotic probe launched by 
NASA to enter Mars orbit and perform meteorological observations. However, 
communications were lost during orbital insertion. The NASA Mishap 
Investigation Board for the Mars Climate Orbiter published a report in 
November 1999 and concluded that the root cause of the accident was that 
programmers had used English units instead of metric units when coding a 
thruster performance software file for “Small Forces” that was used in the 
trajectory models for the spacecraft. The result was a trajectory that resulted in a 
57-kilometer high orbit instead of the planned 226-kilometer orbit. The orbiter 
was lost at a cost of approximately $650 million. 

The Mars Climate Orbiter was just one accident in a long string of losses 
associated with software bugs that also includes military and commercial 
aviation. In 2007, computers on board six U.S. Air Force F-22 fighter jets 
simultaneously failed when the formation flew across the International Date 
Line, resulting in the loss of pilot communication and navigation systems. 

In 2009, a Boeing 737 operating as Turkish Airlines Flight 1951 jet crashed 
on approach to Amsterdam. The altimeter, one of two on the airplane that 
displays the height above ground, malfunctioned. In a perfect example of 
different factors combining to produce an accident, the incorrect altitude reading 
at the time when the aircraft started to follow the glidepath on approach 
triggered the software to greatly reduce power to the engines because the aircraft 
thought landing was imminent. The software simply followed the programming, 
although any human pilot actually hand flying the aircraft and aware of the 
actual altitude above landing would not have reduced engine power so 
significantly in such a circumstance. The crew noticed this too late to take the 
appropriate action to increase the thrust to recover, causing the aircraft to stall 
and the plane to crash. 

Looking at some numbers about software code will help explain why 
protecting aircraft against coding errors and hacking can be complicated. The 
Boeing 787 has 6.5 million lines of software code, a number that has doubled 
every 4 years since 1970. The same reliance on software is present in modern 
cars. The 2010 Mercedes S Class has 20 million lines of code. Software now 
constitutes 70% of an aerospace system’s development cost. When an automated 
analysis was performed of the 2 million lines of code used in the Martian rover 
Curiosity to detect anomalies, around 2,000 defects were detected. Some 
scientists estimate that 15 to 50 errors are present in each 1,000 lines of code. 

Software safety also applies to the support structure for commercial aviation. 


In 2015, a software glitch in a new and much touted air traffic control computer 
system forced controllers to revert to backup, manual procedures. The result was 
almost 500 commercial flight delays and another 470 cancellations up and down 
the U.S. East Coast. The failure was traced to the Lockheed Martin En Route 
Automation Modernization (ERAM) system that replaced a 40-year-old En 
Route Host computer system managing traffic in U.S. airspace at all 20 of the 
FAA’s en route air traffic control centers. 

In aviation, glitches in software extend beyond possible coding errors. The 
aviation industry has made great strides in physical security since the September 
2001 terrorist attacks but it still has not fully addressed potential cyber threats. 
Possible security breaches could cause severe harm to everyday operations. 
Commercial aviation operations depend on a highly networked and 
interconnected system that encompasses voice and data communications 
between aircraft, air traffic control, and satellite stations feeding data through 
this system. Herein lies the problem that the more networked the environment, 
the greater the opportunity to exploit any of its weaknesses. 

Cyber threats will continue to persist in the 21st century and may possibly 
grow, so there will continue to be a need to protect confidentiality, integrity, and 
the availability of information systems as the number of passengers and flights 
increase internationally. Incidents recently have demonstrated that terrorists are 
increasingly interested in targeting the aviation sector. In 2011, radio hackers 
spoke on the frequency of British air traffic controllers, giving fictitious 
instructions to pilots and making fake distress calls. Again in 2011, the Internet 
security company Pure Hacking executed an infiltration on an airline network. In 
just one attack, the tester was able to completely compromise an airline network, 
which included capturing credit card numbers, plans, communications, and 
databases. 

Groups interested in hacking include three main parties, all with different 
objectives: 


e Hackers, who represent the largest group, are most interested in the challenge 
of executing a security breach rather than trying to disrupt operations. 


e Terrorists are arguably the most serious threat. Aviation continues to be a 
prime target for those seeking a visible, damaging impact on public 
infrastructure. Though terrorists mainly used the Internet to communicate for 
recruitment and propaganda, there has already been some evidence of them 
conducing cyberattacks. 

e Nation states are the third group interested in cyberattacks. Their hostile 


activities have targeted the aviation industry to gather sensitive and 
proprietary information rather than targeting airports, communication, or 
aircraft in flight. 


Aviation professionals in the United States and Europe disagree on the best 
way to protect the industry from potential cyberattacks. The European Aviation 
Safety Agency (EASA) believes that all airplanes, regardless of size, should be 
subject to the same cybersecurity standards. On the other hand, the FAA believes 
that only larger planes should be subject to stricter requirements. There are no 
strict regulations mandating the industry to report cybersecurity threats and 
incidents. Some lawmakers are urging that there should be more mandated 
reporting of breaches in airlines since they are such a critical component of a 
country’s economy. 

The EASA recently established a special committee to fight the continuously 
changing landscape of cyber threats against aviation. The threat seems daunting 
and immediate, although it should be noted that, to date, no verified cyberattack 
has successfully hacked a commercial airliner’s system while in flight. Yet, this 
does not mean that hackers would not target an aircraft’s networks, ground- 
based systems, navigation, and cabin entertainment. The field of software safety 
and security will likely receive significantly more attention in the near future to 
protect commercial aviation safety. 


HUMAN PERFORMANCE AND RELIABILITY 


LASERS 


One hazard to pilots during flight that bears mentioning is how lasers have 
recently become an increased threat. Over the past few years, there have been 
more and more reports of people on the ground shining lasers up at aircraft. It 
may not seem very harmful, but it actually is equivalent to the flash of a camera 
in a pitch black car at night. Although permanent damage to the eyes from laser 
exposure in these circumstances is rare and such laser effects on vision are 
usually resolved in 2 to 3 days, there are precedents for pilots being visually 
disabled for several years due to laser strikes. The light can temporarily blind 
crew, create glare, and cause distraction. A laser hitting the glass windows on a 
flight deck may refract light across the windshields, making it very hard to see 
outside. Imagine pilots being temporarily blinded when rolling down the runway 
for takeoff or in the final seconds of an approach prior to landing. The effects 
could be disastrous. 


Furthermore, some lasers operate in the infrared part of the light spectrum and 
can damage pilot vision while being invisible. In other words, pilots may suffer 
laser strikes and not know that they have been hit. As of 2015, the FAA recorded 
over 5,000 laser strikes to aircraft per year, up from 2,837 for 2010. Some of the 
leading airports reporting laser strikes in the United States are Los Angeles, 
Phoenix, Houston, Las Vegas, and Dallas Fort Worth. Since the effects of the 
laser severely compromise the safety of pilots, in 2011, the FAA started 
imposing civil penalties on people who pointed lasers at aircraft. In that year, the 
maximum fine was $11,000. However, since the hazard to aviation safety posed 
by lasers is so serious, Congress increased the penalties in 2012, and the FBI has 
made it a felony to disrupt airplanes with lasers. Anyone convicted of pointing a 
laser at an aircraft can now be sentenced to 20 years in prison and a $250,000 
fine. Recently a man was sentenced to 14 years in prison for targeting a Fresno 
Police helicopter with a laser. In addition to pursuing the users of lasers, 
lawmakers have also attempted to legislate the sale of high-powered, long-range 
lasers, which can produce devastating effects yet are rather inexpensive and easy 
to purchase. 


PSYCHOLOGICAL FITNESS FOR DUTY 


On March 24, 2015, an Airbus 320 operating as Germanwings Flight 9525 flying 
from Barcelona, Spain to Diisseldorf, Germany crashed in the French Alps, 
killing all 150 passengers and crew. As details started to emerge in the days 
following the horrific crash, it became known that pilot Andreas Lubitz had 
deliberately crashed the aircraft. 

The initial suspicions were confirmed in the preliminary report published by 
the French authority responsible for civil aviation accident investigations, the 
Bureau d’Enquétes et d’Analyses pour la sécurité de l’aviation civile (BEA). The 
initial findings indicated that the first officer locked the captain out of the flight 
deck and set the aircraft on a collision course into the terrain. Although pilot 
suicides while flying had occurred in the past, the Germanwings disaster caused 
world shock at the notion that one mentally unstable person could bring so much 
pain and suffering to others in such a violent fashion. 

Equally shocking was learning how limited most aircraft operators are to 
detecting the mental health problems of employees. The Germanwings pilot had 
been treated for depression for a lengthy period prior to obtaining his pilot 
credentials and had known suicidal tendencies. Nevertheless, he was still 
certified to fly an extremely sophisticated piece of equipment and had the lives 
of passengers in his hands. A study of the tragedy and of other similar events in 


aviation has revealed interesting findings. Fi shows investigators 
examining the wreckage of Germanwings Flight 9525. 


FIGURE 14-13 Investigators look over the wreckage of an airliner deliberately crashed by a suicidal pilot. 
(Source: French Ministry of the Interior) 


The Germanwings tragedy brought the issue of mental health to the forefront 
in 2015, but there is a significant list of previous events that showcase the 
ongoing importance of psychological fitness for duty. In 1976, a pilot stole an 
Aeroflot An-2 and flew it into the neighborhood where his ex-wife lived, killing 
11 people on the ground. In 1994, a disgruntled Federal Express flight engineer 
facing termination of employment and flying as a deadheading passenger 
attempted to hijack a Federal Express McDonnell Douglas DC-10 operating as 
Flight 705. The hijacker wanted to kill the crew with hammers so that their 
injuries would look like an accident and then planned to crash the aircraft so his 
family could benefit from his life insurance policy. 

Other events pointing to mental instability have taken place in Japan, 
Morocco, Indonesia, Botswana, and off the coast of New York, and some have 
been prevented that otherwise would have been disastrous. For example, in 2012 
a JetBlue captain turned to his first officer before departing on a flight and stated 
that they would not be flying to their destination, and instead, started yelling 
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In March 2016, The Times revealed that 2 months before the Germanwings 
Flight 9525 disaster, an eerily similar event almost occurred. In January 2015, an 
Italian pilot flying a commercial airliner from Rome to Japan, apparently 
distraught at the notion that his wife was threatening to leave him, texted her 
saying that he would kill himself along with his 200 passengers. The wife alerted 
officials who quickly stepped in and remove the pilot from duty prior to the 
flight, without the passengers knowing anything unusual had occurred. The pilot 
is reportedly still on suspension and under psychological evaluation. 

One of the challenges at the heart of these fitness-for-duty events is that there 
is no consistency across the world for dealing with pilot health certification. In 
fact, most airlines do not have any process for the periodic assessment of 
employee mental health once they are hired, even though conditions such as 
depression, anxiety, and mania can be diagnosed. In 2013, the National Survey 
on Drug Use and Health (NSDUH) estimated that approximately one in five 
Americans meets the diagnosis for mental disorders. In the United States, 
medical confidentiality is controlled in great part by the Health Insurance 
Portability and Accountability Act (HIPAA), which prohibits doctors from 
disclosing a patient’s health information without written consent. However, a 
doctor still has an ethical obligation to disclose information when concerned that 
the patient may pose a serious and imminent threat or harm to the public. 

Airline pilots are required to undergo periodical medical screening, but such 
tests are not designed to detect psychological problems. Instead, the tests tend to 
rely on the self-reporting of conditions by the individual. The FAA can fine 
pilots up to $250,000 for omitting or providing false information concealing 
health issues that could impact fitness to perform duties. There are no clear and 
quick methods for doctors or regulators to intervene if they suspect mental 
problems. It is mostly up to individuals to self-police and report problems. 
Individuals may be reluctant to report psychological problems due to the stigma 
that they may have about mental illness or out of fear that it may lead to negative 
action against their professional certificates or employment. Coworkers may not 
report suspected problems in others because they do not want to be branded as 
someone who reports colleagues. 

To encourage pilots to report self-detected mental illnesses, in 2010 the FAA 
started allowing the issuance of medical certificates even if a pilot takes certain 
medications for mild to moderate depression. Before such a provision, the 
disclosure of the conditions would quickly ground the pilot, and therefore, many 
pilots hesitated to discuss their concerns about mental health with physicians As 
a result, pilots were avoiding the treatment they so critically needed. The new 


provision only applies to very specific medications and requires that the pilot 
also abide by certain clinical conditions. 

Research is required to determine how much psychological benefit is gained 
from physical conditioning and other techniques, such as meditation and 
mindfulness training. All aviation professionals should be aware that 
psychological problems, of varying intensity, are not uncommon and that they 
should be observant of coworkers. 

Four months after the crash of Germanwings Flight 9525, in response to the 
preliminary investigative report and due to the lack of current standardized 
guidance across the world, the EASA produced several recommendations for 
consideration by the European Commission: 


e Requiring at least two people on the flight deck at all times 
e Random drug and alcohol testing programs 


e The system of oversight for medical examiners 
e Creating a European aeromedical data repository 


The following month, the International Federation of Air Line Pilots’ 
Associations (IFALPA), representing the interests and rights of pilots, responded 
to the EASA recommendations by countering as follows: 


e Systematic psychological or psychiatric evaluation should only be performed 
when a pilot is being tested as part of the hiring process and prior to 
employment. 

e Once employed, if a need arises for additional testing, known as for-cause 
testing, then such testing should ensure that safeguards are in place to protect 
the pilot. 


The balance between trying to prevent a recurrence of a tragedy such as 
Germanwings Flight 9525 and protecting individual privacy rights presents a 
formidable challenge going forward. The debate centers on the question of 
whether privacy laws protecting medical records from release should provide 
some flexibility for employers of employees with special responsibilities, such 
as airline pilots, aviation maintenance technicians, and air traffic controllers. 
Employers need the flexibility to manage these sensitive issues, yet labor groups 
often feel that such flexibility could compromise privacy, and therefore, 
prospects of continued employment. 

Although a more robust system for detecting emerging mental health 


problems and reporting the condition so that pilots receive prompt medical 
attention may prevent future versions of Germanwings Flight 9525, pilot health 
advocates have also voiced the concern that revealing mental health conditions 
in the interest of safety may actually work against safety. They argue that the 
provision may cause some pilots to attempt to hide their condition instead of 
seeking treatment, although the counter-argument is sometimes made that pilots 
already frequently hide medical conditions that may negatively impact their 
performance. 

One solution as we move into the future is for each airline or flight 
department to implement a carefully constructed fitness for duty program as part 
of their Safety Management Systems (SMS). It is important for the program to 
have confidentiality, dignity, and respect as cornerstones to promote 
participation. When pilots start initial or recurrent training in the airlines, they 
enter intense training and are closely monitored. It is easy to detect any impaired 
aviators during this time because of their high contact with trainers. Back in the 
cockpit though, red flags for poor mental health may go unnoticed. 

The topic of impaired aviators is gaining attention, but this can neglect the 
other key members of a safety value chain, including flight attendants, air traffic 
controllers, ramp agents, and dispatchers. Since there is not a link that bridges 
awareness across all aviation professionals, the NTSB’s 2015 Most Wanted List 
for safety improvements includes items that address these issues. Among the 10 
items cited, the NTSB urgently recommended improving requirements for 
medical fitness for duty and eliminating substance impairment in transportation. 

An important alliance between the European Society of Aerospace Medicine 
(ESAM), the European Association for Aviation Psychology, and the European 
Cockpit Association has formed to endorse a key set of guidelines for assessing 
pilot health and raising awareness for mental health issues. The initiative puts 
recognition and acceptance of potential mental health issues as the first step in 
solving them. There should be a positive environment created for pilots to 
suggest issues and their requests for assistance to be taken seriously. Pilots 
should be able to share their concerns confidentially without it affecting their 
fitness to fly. 

India is also taking measures to improve the process for evaluating the mental 
health of their pilots. Psychometric tests for pilots of Indian airlines were set to 
begin in the first half of 2016. The country’s Institute of Aerospace Medicine 
had started contemplating these tests after the Germanwings crash and set up a 
panel of experts to decide on the psychometric tests for pilots. This panel 
recommended four levels of tests. First round testing would start at the time a 
student wants to enroll for a flving school. The other three stages would be at the 


time of joining an airline or charter company, when being promoted to captain, 
and whenever they exhibit any abnormal behavior. 

Life can be difficult, with some aviation professionals suffering from post- 
traumatic stress syndrome or stressful family events that are difficult to 
compartmentalize when performing professional duties. There are many 
psychiatric disorders that are not screened for that could greatly affect the 
performance of aviation professionals. Future debate will continue on which 
direction the aviation community should go for when screening for these types 
of problems. 


SAFETY MANAGEMENT SYSTEMS 


SMS VARIABLE INTERDEPENDENCIES 


Commercial aviation has managed safety in one way or another since the dawn 
of flight, but over the last decade, regulating government agencies has created a 
useful business approach to accident prevention described as Safety 
Management Systems (SMS). The primary goal of SMS is to institutionalize the 
processes for safety decision making throughout an organization that relies on 
managing safety through measurement. It is a scientific approach to managing 
safety. 

Whether awareness comes through collected numerical data or the input of 
employees, recognizing that there are many opportunities to prevent an accident 
is the first step in moving from a reactive to a proactive or predictive safety 
culture. Safety is not one-directional: it starts both at the bottom of the 
organization and top of the organization. Senior management sets the tone for 
safety and managers are ultimately accountable for safety. CEOs play a critical 
role and so do all aviation professionals, regardless of their positions. 

International Civil Aviation Organization has recommended that all aviation 
authorities design and integrate a SMS system into their operations. The FAA 
has begun working on this through setting up the SMS Advisory and 
Rulemaking Committee (SMS ARC). In addition, they also require that all FAA 
services and offices adopt a common aviation safety management system 
(AVSSMS). 

By using SMS, organizations are able to examine and make decisions about 
their operations. From their analysis, they can readily adapt to change, using 
quantitative methods to promote efficient management through measurement of 
key performance indicators. SMS strongly supports the continuous improvement 
of safetv through data collection and analvsis that nravides valuahle emnloavee 
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feedback. By doing this, SMS has the ability to greatly enhance the safety 
culture across the organization. 

As covered previously in Chapter 12 of this book, the structure of SMS 
includes four components, with each component broken down further into 
elements and processes. To reiterate, the four components and their scope 
include the following: 


e 1.0 Safety Policy: establishing senior management’s commitment to improve 
safety and define the methods, processes, and organizational structure needed 
to meet safety goals 


e 2.0 Safety Risk Management: determining the need for and adequacy of new 
and revised risk controls based on the assessment of acceptable risks 


e 3.0 Safety Assurance: evaluating the continued effectiveness of implemented 
risk control strategies and supporting the identification of new hazards 

e 4.0 Safety Promotion: training and communicating other actions to create a 
positive safety culture within all levels of the workforce 


Even though it is not readily apparent, all of the components, elements, and 
processes of SMS are interconnected. One key area for the future development 
of SMS is determining how changes to one component impact the other 
components and also how one single input can affect the overall SMS. A safety 
professional attempting to use SMS to prevent accidents will assess the health of 
the SMS by relying on audit scores and actual operational safety data. 

Gains have been made in quantifying the health of each SMS component, but 
work remains in determining how an alteration of one component impacts the 
overall SMS and each of the other component within the SMS. Here are some 
examples: Are changes to safety policy or to key safety personnel more 
beneficial to the overall SMS? How does an alteration of safety policy impact 
how change is managed in an organization? How does a change in safety 
communication impact the effectiveness of hazard awareness? Knowing the 
specific impact of changing individual SMS components would help to clarify 
the best steps that should be taken by those charged with overseeing an SMS. It 
is hard to pick which component should be given priority when all measures 
contribute to enhancing the overall safety. The future of SMS will include 
determining such interdependencies and customizing an automated dashboard 
for each organization that can more carefully control the overall system. 

Future SMS development will also focus on quantifying acceptable levels of 
risk and creating management dashboards for determining when operations are 


encroaching on pre-established safety margins. Modern commercial aircraft have 
become so complex that managing the design, tests, and operations can prove to 
be a huge challenge. Since the systems are now so complex, new management 
methods must be developed that are equally capable. 


FUSING PROACTIVE DATA STREAMS 


One future area in SMS that will see significant development is how to integrate 
the different sources of non-accident data, sometimes called near-miss data, to 
detect negative safety trends before they cause problems. However, prior to 
addressing such future data fusion efforts that will allow us to achieve proactive 
and predictive safety, we should understand how we have arrived at the safety 
management approach of today. 

For a long time, the aviation community’s modus operandi reflected a 
reactive safety approach. The relatively low accident rate of today is greatly the 
result of investigators who have studied accidents to determine previously 
unknown or underpublicized hazards, and who then proffered recommendations 
to prevent future accidents. Studying accidents to determine previously unknown 
or, sadly, previously known hazards is an example of reactive safety. The word 
“reactive” may have a negative connotation among some, but it just alludes to 
the fact that accident investigation reveals hazards after they cause damage or 
injury. Reactive safety continues being vitally important to accident prevention. 

As safety management in commercial aviation became more sophisticated, 
safety professionals started channeling their efforts into establishing a proactive 
approach to safety. Although many commercial aviation operators have 
embraced the philosophy and tools of proactive safety, others in the global 
aviation industry lag behind. The lag is particularly true with regard to key 
players in the safety value chain outside of the flight deck, such as maintenance 
and overhaul facilities, air traffic control, and airfield operations. Most safety 
advocates have realized that reactive and active safety alone are insufficient to 
detect hazards to flights fully. Let us explore the concept of proactive safety a 
little more in depth, since many global aviation operators are still evolving their 
SMS from reactive and active safety programs into a proactive and predictive 
direction. 

About half a century ago, forward thinking safety professionals at a couple of 
European airlines pioneered the era of proactive safety. They realized that we do 
not have to wait for bad things to happen to detect hidden hazards. By routinely 
downloading black box flight data, a process known in the United States as 
Flight Operations Quality Assurance (FOQA), they recognized that it is possible 


to add a proactive element to the active and reactive dimensions of flight safety. 
Proactive safety is particularly insightful when flight data analyses are 
accompanied by voluntary reporting programs that foster a nuanced 
understanding of hazards and the sharing of information that would otherwise 
only be known to a small group of employees. 

Currently, there are several programs that will help aviation professionals 
achieve a proactive approach to safety management. The FOQA type programs 
previously discussed are an excellent example of proactive safety since they help 
explain, in great scientific detail, what occurred during any given flight or across 
a series of flights. Having those insights proves fundamental to knowing how 
close we are coming to the limits of safe operation. 

A second measure is voluntary reporting, such as through the Aviation Safety 
Action Program (ASAP) or the Aviation Safety Reporting System (ASRS). This 
second program is NASA’s voluntary and confidential reporting system for 
pilots and other aviation professionals for sharing close calls in the interest of 
improving air safety. ASAP and ASRS help address the reasons why we are 
approaching the limits of safe operations so that measures can be taken before 
accidents occur. 

Other proactive approaches include programs that observe people in their 
work settings, such as Line Operations Safety Audits (LOSA), and surveys 
designed to assess what employees think of their safety culture. Such data 
sources allow safety professionals to assess the root issues behind why we come 
close to the safe limits of operations. 

Despite numerous avenues for people to address safety in a proactive way, 
one of the major challenges to the above systems is that there are no robust 
frameworks to synthesize all the data. All of the systems work independently of 
each other, making it hard to combine information for a holistic view of aviation 
problems. The future will see such efforts taken to the next step, the fusing of the 
data streams so problems are detected even earlier in order to maximize safety. 
Future SMS development will attempt to find more streamlined and efficient 
ways to fuse data collected from such proactive programs for creating a clearer 
picture of what is going on safety-wise in an organization. 

Looking even further into the future of SMS, proactive safety will need to be 
coupled with anticipatory safety and even predictive safety to ensure safe ground 
operations and flights. Anticipatory safety relies less on probabilistic 
measurement and can be more qualitative. Predictive safety is the investigation 
of potential hazards that do not yet exist but that might cause damage the very 
first time they make an appearance. It relies on probability and severity as key 


input variables. Some air safety investigators believe that predictive safety is a 
key missing dimension of many SMS safety risk management and safety 
assurance programs. They claim that any successful effort to further lower our 
accident rate must attempt to attack hazards before they present themselves, in 
addition to relying on the active, reactive, and proactive dimensions of safety. 

An example of predictive safety is addressing potential hazards that may 
emerge when an airline starts operating a new type of aircraft. If the airline is 
used to operating small aircraft and decides to purchase a larger aircraft, 
predictive safety may uncover that current snow removal practices at the airport 
where the aircraft will be based will not provide sufficient wingtip clearance 
from snow banks on certain taxiways now that longer wingspans are involved. 
Such a predictive determination allows the operator to work with the airfield 
manager to adjust snow clearing procedures prior to the delivery of the new 
aircraft. 


TRAINING NEW ACCIDENT INVESTIGATORS 


When a catastrophic plane crash happens, it commands the attention of all media 
outlets. News stations will display countless videos and pictures, and stories will 
continue to pop up in the newspaper. With all that attention, it is easy to lose 
sight of the fact that commercial aviation aircraft accident rates are actually at a 
historic low. The fatal accident rate has been steadily declining over the past 
decades, and in 2015, the Department of Transportation announced its goal to 
reduce U.S. commercial aviation fatalities to no more than 6.9 deaths per 100 
million people on board. Figure 14-14 shows one of the most recent severe 
commercial aviation accidents in the United States. 
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FIGURE 14-14 Picture from the wreckage of the fatal Asiana Airlines Flight 214 in San Francisco in 2013. 
One of the causes of this accident was automation and a lack of situational awareness. (Source: NTSB) 


However, one would not think that lowering the accident rate would, in fact, 
be problematic. With statistics at a 20 year low, the emerging challenge is 
training new accident investigators for commercial aviation accidents in the 
Western world because there are less opportunities to investigate actual 
accidents. Although there are multiple courses to teach eager investigators 
procedures and policies, they are not getting the hands-on experience needed to 
develop skills critical to the trade. Accident investigators count on several major 
skills to perform their duties: 


e Interpersonal skills: communicating and interacting with people. Accident 
investigators must work with a variety of people, from witnesses to scientists. 


e Report writing: each accident requires a report that explains the causes of the 
crash and recommendations to mitigate the causes and effects. For 
commercial aviation accidents in the United States, the NTSB investigates 
and writes the reports. 


e Forensics: the collection, preservation, and analysis of material from the 
accident to help draw conclusions about what happened. A few new 
technologies to aid in this process are electronic mishap tools, optical 
measurements, and software packages for root cause analysis. 


e Data collection and analysis: the gathering of information on certain items 
from the accident or incident to answer questions about what happened. For 
example, an investigator may collect data on engine performance to see if it 
was one of the factors of the crash. 

e International cooperation: working with authorities from around the world to 
gather information and possible wreckage. For the MH 370 flight that went 
missing, a few of the parties involved include Australian, Malaysian, Chinese, 
and American governments. 


Classroom settings are a good environment to learn about these skills, but it is 
not until investigators get to the field that they truly develop them. Universities 
can use crash labs, such as depicted in ire 14-15, or can provide a simulation 
of hands-on experience by creating virtual crash labs. Much like a video game, 
these simulations allow students to walk through a wreckage site and examine 
the scene while dealing with biohazards and working in teams to determine 
causes. They can even collect data on items such as survival factors, human 
factors, aircraft structures, operations, and maintenance. The future of 
commercial aviation safety may become increasingly reliant on virtual reality 
and other simulations as a way of providing quality training with less actual 
accidents to investigate. 


FIGURE 14-15 A university class uses a crash lab to learn about accident investigation techniques. 
(Source: ERAU) 


ENHANCING THE DEPTH OF ACADEMIC EDUCATION 


A new addition to the academic world that will help shape the future of 
commercial aviation safety is the new doctoral degrees in aviation. Until 
recently, there has been a severe lack of doctoral programs that specialize in 
aviation, and thus, academic research in aviation safety has been limited to 
industry, government, and less in-depth academic programs. With the 
requirement of writing a dissertation, there is tremendous potential for aviation 
professionals or traditional university students to explore topics in depth that 
could enhance commercial aviation safety. Now scholars can take advantage of 
the new research potential previously not present. Three prominent aviation 
doctoral programs are presented by Embry-Riddle Aeronautical University 
(ERAU) and the Florida Institute of Technology (FIT) in the United States and 
Cranfield University in the United Kingdom. 

The Daytona Beach Campus of ERAU in Florida is known best for its 
aerospace engineering and aeronautical science programs, but in 2010, the 
campus started offering a Ph.D. in Aviation. The focus of the program is to 
develop aviation scholars who can expand on the existing body knowledge and 
share their findings with the rest of the community. Students start with 
coursework in central theories and concepts in the aviation field; then pose and 
solve theory-based and research-based problems related to real-life scenarios; 
and lastly develop the leadership, collaboration, and communication necessary 
for academic work in aviation. 

South of ERAU in Melbourne, Florida is FIT. It initially opened to be a 
training ground for space industry professionals working at what now is the 
Kennedy Space Center. Today, FIT includes a wide variety of aeronautics, 
engineering, and science disciplines in addition to aviation studies. Their Ph.D. 
in Aviation Sciences and Professional Doctorate in Aviation (Av.D) programs 
offer a customizable mix of theory and practice, which allows students to 
explore aviation research and apply their findings to today’s industry problems. 

Jumping across the Atlantic Ocean, another prestigious Ph.D. program is at 
Cranfield University. Just 50 miles north of London, it is situated on what used 
to be a base for the Royal Air Force. Today, Cranfield academics center around 
science, engineering, technology, and management, offering a Ph.D. in 
Aerospace among other programs. 

These three featured universities join other current and emerging doctoral 
research programs across the globe to help expand aviation knowledge to 
include tackling some of the more vexing challenges to commercial aviation 
safety. The future will hopefully see significant advances to safety based on the 


research products from such programs, and the industry would be wise to watch 
for research findings with great attention so that research recommendations can 
be implemented into all aspects of commercial aviation safety. 

Sample dissertation research topics that have been completed or are currently 
underway at such institutions, and which could significantly enhance 
commercial aviation safety, include the following: 


e The Precursors of Runway Incursions Classified as Pilot Deviations: Factors 
Related to Hazardous Events 


e The Effects of Ethical Leadership and Organizational Safety Culture on 
Safety Outcomes 


e Cognitive and Behavioral Factors Relating to Aviation Professionalism 


e National Culture: Understanding the Impact of Cross-culture on Airline 
Pilots’ Safety Performance in the Middle-East and North Africa (MENA) 
Region 

e Safety Culture Among Worldwide Aircraft and Engine MRO (Maintenance, 
Repair & Overhaul) Providers 


e Behavioral Traps in Flight Crew-Related 14 CFR Part 121 Airline Accidents 


e Validation of New Technology using Legacy Metrics: Examination of Surf- 
IA Alerting for Runway Incursion Incidents 


e An Analysis of Airport Surface Deviations using the Human Factors Analysis 
and Classification System (HFACS) 


ARTIFICIAL INTELLIGENCE 


One area that may have the most profound impact on overall safety in 
commercial aviation and in other transportation modes is the use of machine 
intelligence to detect accidents as they are about to happen and alert operators of 
impending doom. Such an arrangement would effectively constitute the ultimate 
expression safety information sharing and real-time analysis. 

The book has shown how numerous innovations in both technology and 
human performance have dramatically improved the accident rate in commercial 
aviation over the past century but it has also shown that the rate of improvement 
is decreasing given that we have plucked all of the low hanging fruit, so to 
speak. What will produce the next breakthrough? Are accidents something we 
can cure, such as a disease? Scientific progress has allowed the eradication of 


diseases such as yellow fever, smallpox, and the measles. Some medical 
researchers believe that cancer may be next on the list. Can accidents be 
eradicated in commercial aviation, or at least decreased to near zero? Some 
would argue that much of the developed world already expects a zero accident 
rate in commercial aviation, but as a global industry, we are not there yet, and in 
some specific areas, significant work remains to achieve rates comparable to 
those found in developed countries. 


RECENT ADVANCES 


Recent advances in machine intelligence are enabling the creation of software 
that has extremely fast processes. Artificial intelligence can be explained as 
software with the ability to perceive, understand language, learn, reason, and 
solve problems similar or greater than a human being. When such software is 
coupled with other similar programs and tasked with focusing on grasping 
knowledge and relationships, deep learning networks can be created. What was 
once the science fiction concept of artificial intelligence is increasingly 
mainstream for society today. We now have powerful search engines that often 
times appear downright clever, voice and face recognition programs, driverless 
cars, and machines that can beat the best humanity can offer in strategy games 
such as chess, highly complex games such as Go, and game shows such as 
Jeopardy. 

Scientists and engineers involved in developing artificial intelligence are 
quick to point out that 2015 was a key year since that is when advances in 
computational power and techniques allowed machine learning to leap out of 
laboratories and into mainstream use. Significant gains also occurred in machine 
emotional understanding and the ability to learn deeply and quickly in order to 
perfect their own processes. 

For the past quarter century, leaders of the accident investigation community 
have promoted the concept that any given accident is the result of multiple 
causes. Such causal factors can be identified as the accident sequence develops, 
but only if one knows what to look for as the sequence develops. An experienced 
air safety investigator can read an accident narrative and quickly start picking 
out key factors that likely will result in the accident featured in the report. An 
artificially intelligent safety program could be tasked with learning such causal 
factors by reading all the accident and incident reports ever written; by observing 
flight simulator crews as they encounter malfunctions; and by monitoring the 
minor incidents, major incidents, and near accidents that occur in the millions of 
commercial airline flights every year. Such learning could be further augmented 


by analyzing the hundreds of millions of flight data files collected through 
FOQA, ASAP, and LOSA worldwide. 

Doing so would allow the machine to learn how pathogens combine with 
operational variables to produce undesirable events of different severity and also 
to “make sense” of how such combinations can result in nonevents. In other 
words, the machine would learn greatly from both accident and near-miss 
information. The process sounds onerous, and it surely would be for any human, 
but it could actually occur with great speed with modern machine learning 
systems. 

The resulting super intelligence could then be tasked with applying the 
learning to detection, could have an unrivaled ability to recognize when factors 
are combining that appear conducive to an unsafe situation, and could provide an 
alert to the operator when a certain accident probability is reached. Such an 
accident probability alerting threshold could conceivably be set to different 
levels in order to prevent unnecessary false alerts. For example, a threshold set at 
90% would delay alerting until being almost certain that an accident was 
inevitable, barring any immediate intervention. In comparison, a threshold set at 
70% would provide an earlier notice of unfavorable combinations of factors and 
would catch more developing accident sequences but would also provide more 
false alarms, meaning that it would have decreased alerting accuracy. 

It must be stressed that such an alerting system, if designed, would not take 
the form of a robot sitting in a jump seat on the flight deck. Science fiction often 
depicts artificial intelligence as being housed in a robot that mimics human form. 
Instead, the intelligence could reside invisibly within flight deck systems, 
monitoring as many variables as possible through a combination of sensors, and 
comparing the factors detected to the combinations of factors previously learned 
that resulted in an accident or incident. The concept is best described as an 
intelligent “agent,” meaning that it is an autonomous entity that monitors with 
sensors and acts within a given environment to achieve preset goals. 

The intelligent agent would rely on numerous types of sensors to obtain data 
for analysis. Such inputs could consist of laser eye trackers that measure, with 
great precision, pilot gaze and therefore can infer what is capturing a pilot’s 
attention at any time, such as a weather forecast or takeoff performance data. 
Another sensor input could be voice recognition in order to establish precisely 
what checklist is currently being followed and if any procedures or individual 
checklists steps have been missed or incorrectly applied. A voice recognition 
sensor could monitor the intentions discussed during crew briefings, 
conversations with flight attendants that take place both in person and via 
interphone, air traffic control instructions that are received, and what information 


has been exchanged between different aircraft flight crews and between crews 
and dispatchers. 

The ultimate expression of an artificially intelligent system designed to 
promote safety would be the networking of independent agents together to create 
shared learning and also shared recognition of developing situations. If each 
individual intelligent agent was tasked with continuous learning, real-time 
analysis, near-casting of events, and alerting, and then shared that information 
with other agents in the system, the resulting aviation operation would come 
close to achieving a cybernetic expression of a “guardian angel” with the ability 
to intervene just before an accident occurs. Prediction of events further in the 
future would also be possible, with an associated decrease in accuracy the 
further out into the future that events are predicted. The concept is similar to 
now-casting in meteorology, where the accuracy of predicted weather 
phenomena can be quite high in the moments after the prediction is issued and 
for the period immediately following the now-cast, but understandably decreases 
in accuracy the longer the prediction is in effect. 


SITUATIONAL SCENARIO 


What follows is an example of how a network of artificially intelligent agents 
could prevent an accident from loss of control inflight of an aircraft. Imagine an 
airport where arrivals and departures are operating on parallel runways, as is 
common, and in which the following situation develops under the monitoring of 
several intelligent agents networked together to prevent accidents. In the 
scenario, let us say that Agent 1 is tasked with monitoring weather phenomena at 
an airport and could detect an atmospheric development conducive to the 
creation of wind shear that could potentially affect aircraft operating in the 
airport terminal area. Agent 2 may be aboard an Airbus 380 flying a final 
approach to the airport and may have the task of monitoring the performance of 
both pilots. That agent may detect how one pilot is focusing attention on re- 
reading the missed approach instructions on the instrument approach plate 
corresponding to the approach currently being flown and may deduct that the 
pilot is thinking about the possibility of aborting the landing. Agent 3 may be 
aboard the same Airbus 380 aircraft. It may be assigned the task of monitoring 
the performance of the aircraft itself as it approaches the runway and may sense 
a thrust increase along with the associated increase in airspeed which when 
compared to the fluctuating airspeed due to atmospheric turbulence may be 
interpreted as a common pilot precaution against the wind shear. That same 
agent may also model the wake turbulence being produced by the aircraft and 


would know the severity of the wake turbulence at any given time, being able to 
predict how the winds aloft would carry the turbulence. Agent 4 may be aboard 
an Embraer ERJ-140 that is lining up for takeoff on a parallel runway at the 
same airport and be tasked with monitoring the aircraft performance. Such an 
agent would know how much wake turbulence the ERJ-140 can tolerate at any 
given aircraft energy state and would also be aware of the programmed departure 
runway. The final key agent in our network for the scenario, Agent 5, may be 
aboard the ERJ-140 and could be tasked with using voice recognition to detect 
the controller takeoff instructions and subsequent pilot acknowledgment. 

A network of the five previously described artificially intelligent agents may 
produce a safety alert in the described scenario, recommending that the takeoff 
clearance to the ERJ-140 be cancelled. The alert could be produced the instant 
that the network recognizes that a takeoff clearance has been issued to the ERJ- 
140 crew, who could be warned by the system via a voice prompt such as 
“Safety alert! Cancel takeoff clearance.” The flight crew of the ERJ and the 
tower controller may be completely surprised and perplexed by such an alert, 
since there is no obvious safety threat to the departing aircraft. That is because 
the combination of factors that lead to accidents are sometimes only obvious 
after an accident has occurred. In the scenario provided, the artificial intelligence 
network had monitored a large number of factors and had recognized that some 
of the factors were combining in such a fashion that an accident was highly 
probable. Therefore it issued a warning. But how did the network produce such a 
warning? How did it conclude that an accident was probable? 

In the example, Agent 1 told the network that the aircraft on final to the 
arrival runway would probably encounter significant wind shear in the next 
minute of time. Agent 2 shared with the network that the Airbus 380 pilots were 
actively aware of the possible need for a go-around maneuver and would 
probably follow the published missed approach instructions if such a procedure 
were performed. Agent 3 shared that if such a maneuver were to occur, the 
trajectory of the Airbus 380 and the large wake turbulence produced by the 
Airbus 380 would combine with the winds aloft to drift the turbulence directly 
into the departure path of the ERJ-140. Agent 4 predicted the position of the 
ERJ-140 in relation to the wake turbulence and calculated that the turbulence 
would pose a significant threat to the low-energy state of the ERJ approximately 
15 seconds after it became airborne. Agent 5 recognized that takeoff was 
imminent for the ERJ-140. As a result, the network of artificially intelligent 
agents predicted that there was a high probability of the ERJ-140 flying into the 
turbulence and losing control of the aircraft, resulting in an accident. Therefore, 
the safety network immediately produced an alert that recommended the 


cancellation of the takeoff clearance for the ERJ-140. In other words, the super- 
intelligent network predicted an accident and intervened at just the right moment 
to prevent disaster. 

It may be that in the previous example that the pilots of the A-380 decide the 
wind shear is not too severe and end up landing instead of going around. In that 
case, the cancellation of the takeoff clearance for the ERJ-140 would be seen as 
an inefficiency of the predictive intelligence. Perhaps the network would detect 
that the Airbus 380 was continuing to land, instead of going around, and would 
quickly rescind the ERJ-140’s safety alert. In such a case the network could be 
queried for an explanation as to why the alert had been issued, if the flight crew 
or controller wanted to know. It is important to note that the machine learning 
capabilities of each agent would be extremely high and, therefore, each agent 
would learn from each and every “false alert” in order to continuously improve 
the accuracy of its predictive algorithms. Essentially, we are describing a 
constant learning safety network comprised of artificially intelligent agents. 

It should also be noted that an adjustment to the accident probability alerting 
threshold would directly affect the number of false alerts. In the example, a 
threshold set at 50% may have prompted the safety alert when the network 
noticed that the air traffic controller was looking at the ERJ-140 holding short of 
the runway and detected the controller reaching for the push-to-talk switch, 
anticipating a takeoff clearance. In the same scenario, a threshold set at 75% 
may result in a safety alert just after the takeoff clearance is issued, as happened 
in the provided scenario. Or, a threshold set at 90% may have (a) delayed the 
alerting until after the takeoff roll of the ERJ-140 was initiated, then calling for a 
rejected takeoff if the ERJ-140 was still on the runway or (b) called for an 
evasive maneuver if the ERJ-140 was already airborne. 

No human or team of humans could ever combine all the interrelated factors 
in the previous example with sufficient insight and speed to produce a safety 
alert, much less with any semblance of accuracy. Yet such a combination of 
factors is precisely how aviation accidents are caused. A networked system of 
machine intelligences could quickly and accurately determine when a dangerous 
confluence of factors start aligning and then produce an alert at a present 
probabilistic threshold that prevents the loss of control due to the wake 
turbulence encounter. 

Although some experts claim that the time is coming when fully automated 
commercial aircraft, with no onboard pilots, will be the standard means of 
conveyance, before that day arrives, intelligent machines may virtually eliminate 
accidents in the same way that scientists have eliminated certain diseases. 


CONCLUSION 


The future certainly is difficult to predict, but we are able to extrapolate from 
emerging trends to explore probable upcoming developments in commercial 
aviation safety. We can say with certainty that airspace will be increasingly 
congested due to increases in traditional commercial air traffic and also due to 
new types of users of the airspace, such as UAS and suborbital space vehicles. 
There will likely be solutions adopted for the challenges of tracking aircraft 
operating in remote parts of the planet, such as oceanic airspace, and thus 
airliners will no longer go missing without a trace. 

Aircraft themselves will be designed with enhanced safety and security 
systems. Similarly, increased defenses will be provided to counter some of the 
shortcomings of humans, such as the threat of lasers to our vision and life 
stresses that can produce poor psychological fitness for duty. 

The science of safety management will also continue to evolve in 
sophistication, paired with a new generation of the most highly educated safety 
professionals in history. It is particularly interesting to contemplate a future for 
commercial aviation safety where artificial intelligence and SMS risk mitigation 
techniques combine to ensure a seamless safety value chain. 

When taken together, all such developments will continue making 
commercial air travel the safest form of public transportation, which will be 
expected by an increasingly demanding public that is intolerant of accidents and 
serious incidents. 


KEY TERMS 


Accident Probability Alerting Threshold 

Aircraft Communications Addressing and Reporting System (ACARS) 
Artificially Intelligent Agents 

Automatic Dependent Surveillance—Broadcast (ADS-B) 

Bureau d’Enquétes et d’ Analyses pour la sécurité de |’aviation civile (BEA) 
European Aviation Safety Agency (EASA) 

Flight Operations Quality Assurance (FOQA) 

Future Air Navigation System (FANS) 

Global Aeronautical Distress and Safety System (GADSS) 

Health Insurance Portability and Accountability Act (HIPAA) 
International Federation of Air Line Pilots’ Associations (IFALPA) 
Know Before You Flv 
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Line Operations Safety Audits (LOSA) 

NextGen 

No Drone Zone 

Predictive Safety 

Proactive Safety 

Psychological Fitness for Duty 

Reactive Safety 

Required Navigation Performance (RNP) 

Space and Air Traffic Management System (SATMS) 
Space Transition Corridors (STCs) 

Unmanned Aircraft System (UAS) 

Weather Support to Deicing Decision Making (WSDDM) 


REVIEW QUESTIONS 


1. How do commercial aircraft flight crew know what minimum altitudes must 
be flown in order to address threats posed by surface to air missiles? 

2. Explain the potential hazards presented by UAS in today’s airspace. 

3. Explain why it is so hard to prevent illegal UAS operations. 

4. Will integrating commercial space operations into the current air traffic 
control system increase the workload on controllers? Why or why not? 

5. List three challenges associated with oceanic tracking. 


6. Describe one emerging technology available for deicing planes on the 
ground. 


7. Is it too harsh to charge a civilian with a felony for pointing a laser up at a 
plane? Discuss your response. 


8. Differentiate between physiological and psychological fitness for duty. Is it 
more important to screen for physiological or psychological fitness for 
duty? Or should they be given equal consideration? 


9. What are the potential benefits and drawbacks associated with requiring 
doctors to report pilot psychological problems? 


10. If you were a safety management system manager who was given an extra 
$500,000 to invest, would you choose to invest it in hazard identification 
and analysis or training competencies? What is your rationale for deciding 
to invest where you did? How do you think this will affect the overall safety 


management system? 

11. What are some topics from this chapter that you would be interested in 
exploring if you were to pursue an aviation-related Ph.D. or Av.D degree? 
Why do you think your choices merit additional research? 


12. Provide a specific example of how a future warning system based on 
artificial intelligence may prevent an accident. 


SUGGESTED READING 


Jackman, F. (2015, September). Psychological evaluations proposed. AeroSafety 
World, 10(7), 8. 

Sio-Iong, A. Rieger, B., & Amouzegar, M. (2011). Machine learning and 
systems engineering. Dordrecht, the Netherlands: Springer. 

Stolzer, A. & Goglia, J. (2015). Safety Management Systems in Aviation (2nd 
ed.). Farnham, England: Ashgate. 

Sun, X., Damle, V. G., Liu, S., & Rykaczewski, K. (2015). Bioinspired stimuli- 
responsive and 

antifreeze-secreting anti-icing coatings. Advanced Materials Interfaces, 2(5). 
[1400479] doi: 10.1002/admi.201400479 

Wayne, R. (2015, July-August). ‘Failing aviator’ solutions. AeroSafety World, 
10(6), 12-16. 

Werfelman, L. (2015a, November). Crackdown. AeroSafety World, 10(9), 37— 
Al. 

Werfelman, L. (2015b, June). State of mind. AeroSafety World, 10(5), 12-15. 


WEB REFERENCES 


Article on the amount of flight data available on modern jets: 
http://www.computerworlduk.com/news/data/boeing-787s-create-half- 
terabyte-of-data-per-flight-says-virgin-atlantic-3433595/ 

Recent near midair collision with drone: 
http://www.bloomberg.com/news/articles/2016-03-04/drone-brushes-past- 
airbus-jet-above-paris-in-closest-shave-yet 

Recent revelation of near suicide by pilot: 
http://www.independent.co.uk/news/world/europe/italian-pilot-threatened-to- 
crash-passenger-jet-if-his-wife-left-him-a6916511.html 

Regulator in the United States: http://www.faa.gov 


Sample aviation doctoral program: http://www.cranfield.ac.uk 

Sample aviation doctoral program: http://www.erau.edu 

Sample aviation doctoral program: http://www.fit.edu 

The state of artificial intelligence: https://www.youtube.com/watch? 
v=VBceREwF7SA 

Transportation safety investigations in the United States: http://www.ntsb.gov 


INDEX 


INDEX 


Please note that index links point to page beginnings from the print edition. 
Locations are approximate in e-readers, and you may need to page down one or 
more times after clicking a link to get to the indexed material. 


Note: Page numbers followed by f denote figures. 


AASR. See Aging Airplane Safety Rule 
AC. See Advisory Circulars 
ACARS. See Aircraft Communications Addressing and Reporting System 
Accident(s) 

definitions of, 4—5 

history of significant, 17—24 

vs. incidents, 4 

myths about, 7—10 

precursors to, 10—11 

prediction of, 8—9 

types of, 5, 371 
Accident causation. See Causation 
Accident counts, 371 
Accident investigations. See Investigations 
Accident probability alerting threshold, 496, 498 
Accident rates, 369—384 

vs. accident counts, 371 

Boeing on, 374—379, 376f, 377f, 378f 

definition of, 371 

future of, 495 

and increase in traffic, 244 

international, 381 

measuring, 370—372 


occupational, 381-383 

sources of data on, 372—381 

U.S., 379-380 
Accident sites, 221—223 
Accident theory, definition of, 53. See also Models 
Accidentology, 53 
Accountability, empowered, 121, 124—126 
Accountable Executive (AE), 392-394, 408 
Accredited representatives, 213 
Accuracy, in human performance, 97 
ACGIH. See American Conference of Governmental Industrial Hygienists 
ACI. See Airports Council International 
ACM. See Airport Certification Manual 
ACMS. See Aircraft Condition Monitoring System 
Active causes 

alternative terms for, 49 

case studies on, 47—52 

definition of, 45 

vs. root causes, 45, 49—50 
Active failures, 56—57, 108 
Active listening, 139 
Active safety 

definition of, 27, 244 

examples of, 27, 29 
Active safety devices, 398 
Acts of God, 9-10, 33 
ADM. See Aeronautical decision making 
Administration and Resources Management, EPA Office of, 193 
Administrative Law Judges, NTSB Office of, 218 
Administrative Procedures Act (APA), 184 
Administrator, EPA Office of the, 193 
Administrator, FAA Office of the, 177 
ADS-B. See Automatic dependent surveillance broadcast 
Advanced Imaging Technology (AIT), 444—445 
Advanced Material Interfaces, 479 
Advanced Qualification Program (AQP), 131, 255-256 


Advanced Technologies and Ocean Procedures (ATOPs), 358 
Advisory and Rulemaking Committee (ARC), SMS, 390, 488 
Advisory Circulars (AC), FAA, 318 
60-22, 153 
120-54A, 255 
120-60, 332 
120-66B, 250 
120-80, 278 
120-82, 246 
120-90, 254 
120-92B, 391, 414 
120-93, 277 
120-103A, 102, 123 
150 series, 326, 327, 330 
150/5200-37, 336 
150/5210-22, 318-319 
150/5360-9, 322 
150/5360-13, 322 
AE. See Accountable Executive 
AEP. See Airport Emergency Plan 
Aerobic activity, 122—123 
Aeronautical decision making (ADM), 98-99 
in CRM Pyramid model, 137, 137f, 152-153 
DECIDE model of, 99, 99f 
definition of, 98, 137, 152 
AFA. See Association of Flight Attendants 
Age 
of aircraft, 275-277 
of pilots, 187 
Aging Aircraft Safety Act, 277 
Aging Airplane Safety Rule (AASR), 277 
Air and Radiation, EPA Office of, 193 
Air carrier. See Airline 
Air Carrier Standard Security Program, FAA, 433 
Air Commerce Act of 1926, 16 
Air Florida, 129 


Air Force, U.S. 
on accident causation, 47 
on Crew Resource Management, 126—127 
on definition of findings, 208 
software problems at, 481 
Air France 
Flight 358 accident, 44, 45f 
Flight 447 accident, 23, 213-214, 470, 471f, 472 
Flight 4590 accident, 21, 70-76, 72f, 73f, 75f 
Air India Flight 182 bombing, 428 
Air Line Pilots Association (ALPA), 401—403 
Air Marshal Program, 433—434, 434f 
Air Navigation Bureau (ANB) of ICAO, 170 
Air Navigation Commission of ICAO, 170 
Air pollution, 195, 261 
Air route traffic control centers (ARTCCs), 353 
Air Traffic Control (ATC), 349-367 
ASRS examples of problems with, 113, 361-362 
basic components of, 352—355 
case study on, 362-364 
communication forms used in, 143, 144f 
communication problems in, 103 
future challenges in, 462—478 
history of, 350-352 
mission of, 350 
in mission of FAA, 176 
NextGen, 350, 350f, 352, 356-358 
professionalism in, 122 
in runway incursions, 335 
software problems at, 481—482 
and Unmanned Aircraft Systems, 358—360 
worker strike at, 351 
Air traffic control towers (ATCTs), 353 
Air Traffic Organization (ATO), 177-180, 352 
Air Traffic Safety Action Program (ATSAP), 250, 251f 
Air traffic safety systems. See Air Traffic Control 


Air Transport Committee of ICAO, 170 
Air Transportation Association, 433 
Airbus 
A-320, 286, 303 
A-350, 291 
A-380, 291 
cybersecurity at, 451 
design strategies of, 300-301 
flight decks of, 291 
Aircraft, 265-314 
and atmospheric conditions, 279-284 
automation in, 267, 287—290, 302—303 
cabins of, 277—278 
control strategies in, 299-303 
flight deck enhancements in, 290—295 
flight deck human—machine interface in, 285-287, 302-303 
future of, 303—309, 478—483 
high-lift systems in, 270—271 
jet engine development for, 267—269 
modeling, design, and testing tools for, 295—299 
number in air, 350 
security through strengthening of, 450 
stopping systems of, 271-273 
structural integrity of, 273—277 
Aircraft Accident and Incident Investigation (ICAO Annex 13), 212-213, 216 
Aircraft Communications Addressing and Reporting System (ACARS), 246, 
293-294, 473 
Aircraft Condition Monitoring System (ACMS), 246 
Aircraft Fuel Servicing (NFPA 407), 326 
Aircraft Fueling Ramp Drainage (NFPA 415), 326 
AIRcraft Maintenance ANalysis (AIRMAN), 295 
Aircraft Operations Standard Security Program (AOSSP), 433 
Aircraft Rescue and Firefighting (ARFF), 329-331, 330f 
Airline(s). See also specific airlines 
deregulation of, 182, 183, 301 
FAA certification of, 183 


mergers of, 183 
safety data of, 373-374 
Airline Deregulation Act, 301 
Airline Safety and Federal Aviation Administration Extension Act, 102, 186 
Airline Transport Pilot (ATP), 186 
Airline Transport Pilot Certification Training Program (ATP-CTP), 186-187 
Airlines for America, 380 
Airmail Service, U.S., 200, 200f 
AIRMAN. See AlRcraft Maintenance ANalysis 
Airport(s), 315—348 
ASRS examples of problems at, 338—343 
case study on, 343-344 
certification of, 316—319 
classification of, 317—318 
definition of, 316 
operational safety at, 320-332 
terminal buildings of, 320-321 
Airport Certification Manual (ACM), 318-319, 330 
Airport Emergency Plan (AEP), 319, 330 
Airport Movement Area Safety System (AMASS), 337 
Airport Operating Certificates (AOCs), 317—318 
Airport Surface Detection Equipment, Model X (ASDE-X), 337, 357 
Airport surface environment, 334—336 
Airport surface events, 336 
Airport Surveillance Radar (ASR), 353 
Airport workers, screening of, 456 
Airports (ARP), FAA Office of, 180 
Airports Council International (ACI), 431 
Airspace. See also National Airspace System 
classification of, 352 
future utilization of, 463—464 
Airworthiness, 182, 185—186, 413 
Airworthiness Directives, FAA, 185-186 
AIT. See Advanced Imaging Technology 
ALARP. See As low as reasonably practicable 
Alaska Airlines, 21 


Alerts, in safety risk management, 397—398 
Allied Pilots Association, 401 
Aloha Airlines Flight 243 accident, 19, 275, 277 
ALPA. See Air Line Pilots Association 
Alphabet, phonetic, 143 
Al-Qaeda, 426-427, 474. See also September 11, 2001, terrorist attacks 
AMASS. See Airport Movement Area Safety System 
American Airlines, 224 
Flight 11 hijacking, 436 
Flight 77 hijacking, 436 
Flight 587 accident, 21 
safety data of, 374 
American Conference of Governmental Industrial Hygienists (ACGIH), 327 
American Eagle, 20 
American National Standards Institute (ANST), 320, 321 
American Recovery and Reinvestment Act, 444, 446, 447 
ANB. See Air Navigation Bureau 
Angle of attack (AOA), 303 
ANSI. See American National Standards Institute 
Anticipatory safety, 491 
Anti-hijacking or Air Transportation Security Act, 433 
Antihistamines, 231 
Anti-icing, 331-332, 478—480 
Antiskid systems, 271 
AOA. See Angle of attack 
AOCs. See Airport Operating Certificates 
AOPA, 337 
AOSSP. See Aircraft Operations Standard Security Program 
APA. See Administrative Procedures Act 
Apollo program, 128 
Approach briefings, 148 
AQP. See Advanced Qualification Program 
ARAC. See Aviation Rulemaking Advisory Committee 
ARC. See Advisory and Rulemaking Committee 
Area navigation (RNAV), 353 
ARFF. See Aircraft Rescue and Firefighting 


Aristotle, 43 
Armavia, 22 
Army, U.S., 16 
Arnold, Hap, 268 
ARP. See Airports 
Arrivals, in NextGen program, 357, 358f 
ARTCCs. See Air route traffic control centers 
Artificial intelligence, 494—499 
Artificially intelligent agents, 497—499 
As low as reasonably practicable (ALARP), 11, 394, 396, 404 
ASAP. See Aviation Safety Action Program 
ASDE-X. See Airport Surface Detection Equipment, Model X 
Ash. See Volcanic Ash 
Asiana Flight 214 accident, 23, 24f, 62, 62f, 105, 106, 220f, 230, 492f 
ASIAS. See Aviation Safety Information Analysis and Sharing 
ASR. See Airport Surveillance Radar 
ASRS. See Aviation Safety Reporting System 
ASRS Directline, 252—254 
Assembly, of ICAO, 169-170 
Assertiveness 
in Crew Resource Management, 134—135 
definition of, 134 
with respect, 134-135, 141 
Association of Flight Attendants (AFA), 403 
ATC. See Air Traffic Control 
ATCTs. See Air traffic control towers 
Atmospheric conditions, safety design for, 279-284 
ATO. See Air Traffic Organization 
ATOPs. See Advanced Technologies and Ocean Procedures 
ATP. See Airline Transport Pilot 
ATP-CTP. See Airline Transport Pilot Certification Training Program 
ATSA. See Aviation and Transportation Security Act 
ATSAP. See Air Traffic Safety Action Program 
Attention, in human performance, 98 
Attitude, in human performance, 98 
Attitude indicator, 303 


Audits, 407—409 
comprehensive, 408, 409f 
external, 407 
vs. inspections, 408 
internal, 407 
self, 409 
status, 409 
Authority 
in Crew Resource Management, 133—134 
definition of, 133 
delegation of, 140 
gradients of, 141-143, 142f, 158 
informal vs. formal, 142 
with participation, 133—134, 139 
Auto slat gapper, 273 
Automatic braking system, 272 
Automatic dependent surveillance broadcast (ADS-B), 305, 309, 356, 451, 463— 
464 
Automation, 287—290 
in aircraft design, 267, 287—290, 302-303 
and human error, 91, 104—107, 288-289 
in situational awareness, 86 
Automation surprise, 105—106, 288 
Autopilot, 288 
Auto-throttles, 288, 294 
Avianca Flight 203 bombing, 428 
Aviate, Navigate, Communicate, 87, 87f, 310 
Aviation, sectors of, 2—3 
Aviation and Transportation Security Act (ATSA), 439 
Aviation Disaster Family Assistance Act, 228 
Aviation human factors, 88. See also Human factors 
Aviation Rulemaking Advisory Committee (ARAC), 184 
Aviation Rulemaking Committee (ARC), SMS, 390 
Aviation Safety, FAA Office of (AVS), 180 
Aviation Safety, NTSB Office of (OAS), 217—218 
Aviation Safety Action Program (ASAP), 27, 249-250, 490 


Aviation Safety Information Analysis and Sharing (ASIAS), 256-257 
Aviation Safety Reporting System (ASRS), 250-254 
establishment of, 250—252 
publications of, 252-254 
purpose of, 27, 250-252, 490 
web interface of, 252, 253f 
Aviation Safety Reporting System (ASRS) examples, 29-33 
on advanced aircraft technologies, 309-310 
on Air Traffic Control, 113, 361—362 
on airports, 338—343 
on Crew Resource Management, 157—158 
on government regulation, 198—199 
on human error, 110-113 
on Safety Management Systems, 417—420 
on security, 452—455 
Aviation Security (AVSEC), 429. See also Security 
Aviation Security Improvement Act, 435—436 
Aviation Weather Center, NWS, 280 
Aviation Weather Research program, FAA, 280 
AVS. See Aviation Safety 
AVSEC. See Aviation Security 


Backscatter x-ray imaging, 445 
Baggage 
matching with passengers, 435 
screening of, 447 
security of, 435 
strengthening containers for, 450 
Bathtub curve, 277 
Battelle Laboratories, 251 
BEA. See Bureau d’Enquétes et d’ Analyses 
Between-fleet standardization, 301 
Bin Laden, Osama, 441 
Biometric technology, 449 
Biometrics, 449 
Bird strikes, 67 


Black boxes, 224. See also Cockpit voice recorders; Flight data recorders 
Blood priority, 166, 206 
Bloodborne pathogens standard, 191 
BLS. See Bureau of Labor Statistics 
Blunders, embracing, 62, 84 
Board members, NTSB, 217 
Board of Inquiry, NTSB, 225 
Body scanners, full, 445 
Boeing 
727, 271, 2/2, 206 
737, 272, 291-292 
747, 286, 287, 295 
757, 286, 287, 303 
767, 287, 297, 303 
777, 290, 296 
787 Dreamliner, 7, 185, 290, 299 
B-47, 269-270 
B-367-80 (Dash 80), 270 
cybersecurity at, 451 
flight decks of, 285-287, 290 
safety data of, 374-379, 376f, 377f, 378f 
safety design strategies of, 14, 300-301 
security design strategies of, 14 
Boeing Transonic Wind Tunnel (BTWT), 269 
Bohr, Niels, 462 
Bombings 
evolution of U.S. response to, 434—436 
history of, 428—429 
BP oil spill, 197 
Brakes 
antiskid, 271 
automatic, 272 
speed, 272 
Breathing equipment, protective, 278 
Briefings, 147—150, 147f 
approach, 148 


before-flight (CRM), 147-148 

flight attendant emergency, 148—150 

major components of, 147 

passenger pre-flight, 148, 278 

takeoff, 148 
British Airways, 246 
British European Airways, 128 
BTWT. See Boeing Transonic Wind Tunnel 
Building codes, 320 
Bureau d’Enquétes et d’ Analyses (BEA), 71-74, 213, 465, 484 
Bureau of Labor Statistics (BLS), 258, 382-383, 452 


CAA. See Clean Air Act 
Cabin safety, 277—278 
CAEP. See Committee on Aviation Environmental Protection 
CALLBACK (newsletter), 252 
Cannon-Bowers, J. A., 150 
CASC. See Central air safety chairperson 
CAST. See Commercial Aviation Safety Team 
CATMT. See Collaborative Air Traffic Management Technologies 
Causal factors, 369 
Causation, accident, 37—80. See also Multi-causality 
active vs. root, 45—52 
case studies of, 46—52, 70—76 
chain of, 39 
complexities of determining, 42—45 
definition of, 47—48, 208 
5-Factor model of, 60—69, 60f 
in investigations, 208—211 
and luck, 69—70 
monocausal approach to, 211 
myths about, 9-10, 90-92 
Reason’s “Swiss Cheese” model of, 54—58, 55f, 56f, 58f 
SHELL model of, 59—60 
three-step test for, 208—211 
CBIS. See Checked Baggage Inspection Systems 


CDTI. See Cockpit display of traffic information 
Census of Fatal Occupational Injuries, 381 
Central air safety chairperson (CASC), 402 
Central air safety committee, 402 
Central Intelligence Agency (CIA), 442 
Central maintenance computer system (CMCS), 295 
CEO. See Chief executive officer 
CERCLA. See Comprehensive Environmental Response, Compensation, and 
Liability Act 
CertAlerts, 318 
Certification, FAA 
airline, 183 
airport, 316—319 
CFD. See Computational fluid dynamics 
CFIT. See Controlled flight into terrain 
CFR. See Code of Federal Regulations 
CGI. See Computer-generated imagery 
Chain 
of causation, 39 
event or error, 48 
Change management, 404 
Checked Baggage Inspection Systems (CBIS), 447 
Chemical Safety and Pollution Prevention, EPA Office of, 193 
Chicago Convention 
Annex 6 of, 389 
Annex 13 of, 212-213, 216 
Annex 17 of, 430—431 
Annex 19 of, 174-175, 391, 405 
Articles of, 173, 212 
major accomplishments of, 168 
Chief executive officer (CEO) 
as Accountable Executive, 393 
pilot-in-command as, 139 
in Safety Management Systems, 393, 488 
China Airlines, 21, 105 
China Northern Airlines, 21 


CIA. See Central Intelligence Agency 
Circadian fatigue, 101 
CIRP. See Critical Incident Response Program 
Civil Aviation Security General Rules, 440 
Clean Air Act (CAA), 195 
Clean Water Act (CWA), 195-196, 260, 261 
Clinton, Bill, 436 
Clock, 24-hour, 143-144 
CMCS. See Central maintenance computer system 
CNS/ATM. See Communications, navigation, and surveillance/air traffic 
management 
Cockpit 
glass, 285, 290, 302-303 
sterile, 86-87, 231 
Cockpit display of traffic information (CDTI), 305, 306f 
Cockpit door reinforcement, 450 
Cockpit Resource Management (CRM), 129. See also Crew Resource 
Management 
Cockpit voice recorders (CVRs) 
in NTSB investigations, 219, 220f, 223—224 
technological advances in, 298-299 
Code of Federal Regulations (CFR) 
14 CFR 5, 391, 413-414 
14 CFR 61, 360 
14 CFR 91, 134 
14 CFR 107, 359-360 
14 CFR 121, 134, 255, 256 
14 CFR 125, 134 
14 CFR 135, 134, 255, 256 
14 CFR 139, 326 
29 CFR 1904, 258 
29 CFR 1910, 320-325, 327, 329, 332 
49 CFR 1500, 440-441 
Coding errors, 481—482 
Cognition, 92 
Cognitive error, 92—93, 95 


Cognitive expectancies, false, 95 
Colgan Air Flight 3407 accident, 23, 122, 186-187, 227-228, 227f, 390 
Collaborative Air Traffic Management Technologies (CATMT), 356 
Collisions 
midair, 362-364, 363f 
warning systems for, 13, 292 
Columbia (space shuttle), 470 
Comair 
Flight 191 accident, 22 
Flight 3272 accident, 284 
Flight 5191 accident, 122, 333 
whistleblower case at, 12 
Commercial aviation, definition of, 3 
Commercial Aviation Safety Team (CAST), 256 
Commercial space operations, 466—470, 467f, 469f, 470f 
FAA oversight of, 184 
future challenges with, 466—470 
Commercial Space Transportation, FAA Office of, 184, 467 
Committee on Aviation Environmental Protection (CAEP) of ICAO, 197 
Communication 
ASRS example of problems with, 112-113 
common language used in, 143—146 
in CRM Pyramid model, 137, 137f, 143-146 
definition of, 103 
forms of, 143 
future of, 304—306 
problems in, 103—104 
in safety promotion, 411—413, 412f 
in situational awareness, 96 
Communications, navigation, and surveillance/air traffic management 
(CNS/ATM), 304 
Complacency, in human performance, 98 
Complete failure, 275 
Comprehensive audits, 408, 409f 
Comprehensive Environmental Response, Compensation, and Liability Act 
(CERCLA), 196, 260, 261 


Compressed gas, 322-323 
Computational fluid dynamics (CFD), 296—297 
Computer-generated imagery (CGI), 298 
Computerworld UK, 473 
Conceptual models, 53-54. See also Models 
Concorde aircraft, 21, 70—76, 71f 
Confined spaces standard, 191—192 
Contact technique, 446 
Continental Express, 155 
Continuous monitoring, 407 
Control strategies, for threat and error management, 299—303 
Controlled airspace, 352 
positive, 352 
Controlled flight into terrain (CFIT), 128, 292, 480 
Controller Pilot Data Link Communications (CPDLC), 294 
Convention on International Civil Aviation, 174 
Coolidge, Calvin, 16 
Coonts, Stephen, The Intruders, 121—122 
Coordinated Universal Time (UTC), 144 
Coordination 
in CRM Pyramid model, 137, 137f, 146—150 
definition of, 146 
Corporate aviation, definition of, 2 
Corrective action, 408 
Council, of ICAO, 170 
Courage, ethical, 140 
CPDLC. See Controller Pilot Data Link Communications 
Cracks, 273—277 
Cradle-to-grave approach, 196 
Cranfield University, 493, 494 
Crash labs, 492, 493f 
Crew alerting systems, 64—65, 287, 291-293 
Crew Resource Management (CRM), 89, 126-138 
ASRS examples of, 157—158 
case study on, 155—156 
central theme of, 132-135 


definition of, 126, 129 
evolution of principles of, 127—132 
failures in, 90 
fundamental skill sets in, 127 
goals of, 126-127 
proof of effectiveness of, 135—136 
Crew Resource Management (CRM), Pyramid model of, 136-155, 137f 
aeronautical decision making in, 137, 152-153 
communication in, 137, 143—146 
coordination in, 137, 146—150 
culture in, 138, 153-155 
leadership and followership in, 137, 138-143 
Shared Situational Awareness in, 137, 150—152 
Crew roles, predetermined, 151 
Crew-caused accidents, data on, 374 
Critical Incident Response Program (CIRP), 402 
CRM. See Cockpit Resource Management; Crew Resource Management 
CRM briefings, 147—148 
Culture 
in CRM Pyramid model, 138, 153-155 
definition of, 138, 153 
just, 124, 392 
national, 153 
organizational, 153, 154—155 
professional, 153, 154 
safety, 124, 155 
Cumulative fatigue, 101 
CVRs. See Cockpit voice recorders 
CWA. See Clean Water Act 
Cybersecurity, 450-452, 480—483 


Damage accidents, definition of, 5, 371 
Damage tolerance, 274—275, 276 
Data, routine flight, 245 
Data, safety, 369-384 
introduction to, 369-372 


sources of, 372—381 
Data Acquisition and Analysis Working Group, 90 
Data analysis 
in accident investigations, 492 
in Safety Management Systems, 420 
Data collection, in accident investigations, 492 
Data Communications (Data Comm), 356 
Data entry, as sterile operation, 289 
Data envelopment analysis (DEA), 416 
Data fusion efforts, 489-491 
Data Management Units (DMUs), 246—247 
Data recorders. See Flight data recorders 
Databases 
ASIAS, 257 
ASRS, 252, 253f 
NTSB, 229 
DEA. See Data envelopment analysis 
Deaths. See also Fatality rates 
OSHA reporting requirements on, 258 
probability of, 369-370 
Debriefings, post-event, 151 
DECIDE model of aeronautical decision making, 99, 99f 
Decision making, in human performance, 98—99. See also Aeronautical decision 
making 
Decision support tool (DST), 468 
Defense Intelligence Agency, 442 
Deicing, 331-332, 331f, 478—480 
Delta Airlines, 18 
Deming, W. Edwards, 388 
Departures, in NextGen program, 357 
Depression, 484, 486 
Deregulation of airlines, 182, 183, 301 
Desensitization, 10 
Design and engineering, 398 
Devices, safety, 397, 398 
DFDR. See Digital flight data recorder 


DHL, 478 
DHS. See Homeland Security, Department of 
Digital communications, future of, 304—306 
Digital flight data recorder (DFDR), 401 
Diphenhydramine, 231 
Director of National Intelligence (DNI), 442 
Disabilities, passengers with, 320 
Disaster incubation period, 11 
Display system, integrated (IDS), 287 
Displays 
cockpit, of traffic information, 305, 306f 
heads-up, 308-309, 308f 
liquid crystal, 290, 291, 306-307 
multifunction, 288, 291, 307, 307f 
navigation, 287 
primary flight, 287 
Distance Measuring Equipment (DME), 353 
Distractions, 10 
ASRS example of, 110 
NTSB on, 231 
smartphones as, 107 
sterile cockpit rule on, 86-87, 231 
Distress tracking system, 474 
Ditching, definition of, 278 
DME. See Distance Measuring Equipment 
DMUs. See Data Management Units 
DNI. See Director of National Intelligence 
Doctoral programs, 493—494 
Documentation, in Safety Management Systems, 394 
Dog explosive detection teams, 439, 440f 
Doors 
airport, 321 
cockpit, 450 
DOT. See Transportation, Department of 
Down East Airlines, 155 
Drones. See Unmanned Aircraft Systems 


Drug impairment, NTSB on, 231 
DST. See Decision support tool 
Duty time limitations, 187—188 


EAFRs. See Enhanced airborne flight recorders 
EAs. See Environmental Assessments 
EASA. See European Aviation Safety Agency 
Eastern Airlines, 128 
ECAM. See Electronic Centralized Aircraft Monitor 
EDSs. See Explosive detection systems 
Education 

of accident investigators, 491—492, 493f 

doctoral, 493—494 

of pilots, 186-187 

safety, 410-411 
Edwards, Elwyn, 59 
EFBs. See Electronic flight bags 
EFIS. See Electronic flight instrument system 
EFVS. See Enhanced flight vision system 
Ego, in human performance, 99—100 
EGPWS. See Enhanced ground-proximity warning system 
EICAS. See Engine Indicating and Crew Alert System 
EISs. See Environmental Impact Statements 
ELACs. See Elevator/aileron computers 
Electronic Centralized Aircraft Monitor (ECAM), 64—65, 292-293 
Electronic flight bags (EFBs), 290, 291, 309, 337 
Electronic flight instrument system (EFIS), 64—65 
Electronic-enabled (e-Enabled) aircraft, 451 
Elevator/aileron computers (ELACs), 294—295 
EMAS. See Engineered Materials Arrestor System 
Embracing blunders, 62, 84 
Embry-Riddle Aeronautical University (ERAU), 493 
Emergency briefings, 148—150 
Emergency Planning and Community Right-to-Know Act (EPCRA), 260 
Emergency response drills, 400—401 
Emergency Response Plan (ERP), 394, 400—401 


Emirates Flight 407 accident, 70, 289 
Emissions 
aircraft, 261 
greenhouse gas, 195 
Employee reporting systems, 407 
Empowered accountability, 121, 124—126 
En Route Automation Modernization (ERAM), 482 
En route operations, 357—358 
Endsley, Mica, 94 
Enforcement and Compliance Assurance, EPA Office of, 193-194 
Engine Indicating and Crew Alert System (EICAS), 64—65, 287, 292-293 
Engineered Materials Arrestor System (EMAS), 343-344, 344f, 345f 
Engineering technical investigations, 208 
Engines. See Jet engines 
English language, 145 
Enhanced airborne flight recorders (EAFRs), 299 
Enhanced flight vision system (EFVS), 308-309 
Enhanced ground-proximity warning system (EGPWS), 292 
Entebbe, Operation, 429, 430f 
Environmental Assessments (EAs), 195 
Environmental factors 
in 5-Factor model, 66—68 
in human performance, 100 
Environmental Impact Statements (EISs), 195 
Environmental Information, EPA Office of, 194 
Environmental laws, major, 195—198, 260 
Environmental Protection Agency (EPA), 192—198 
establishment of, 192 
mission of, 192—193, 260 
organization of, 193-194 
reporting requirements of, 260—261 
rulemaking by, 194-195 
EPA. See Environmental Protection Agency 
EPCRA. See Emergency Planning and Community Right-to-Know Act 
ERAM. See En Route Automation Modernization 
ERAU. See Embry-Riddle Aeronautical University 


ERC. See Event Review Committee 
Ergonomics, 192 
Ernst, Edzard, 43—44 
ERP. See Emergency Response Plan 
Error(s). See also specific types 
aircraft control strategies for management of, 299-303 
caused by threats, 132 
in TEM framework, 132 
Error chains, 48, 89—90 
Error-resistant systems, 303 
Error-tolerant systems, 303 
ESAM. See European Society of Aerospace Medicine 
Ethical courage, 140 
Ethics, safety, 10-13 
ETOPS. See Extended-range twin-engine operations 
European Association for Aviation Psychology, 487 
European Aviation Safety Agency (EASA), 482—483, 486 
European Cockpit Association, 487 
European Society of Aerospace Medicine (ESAM), 487 
Evacuation 
airplane, 24, 278 
airport, 320 
Event chains, 48. See also Error chains 
Event Review Committee (ERC), 250 
Executive air safety chairman, 402 
Executive Order 13354, 441—442 
Expectancies 
definition of, 95 
false, 95, 128 
in situational awareness, 95—96 
Expert witnesses, 225 
Explosions 
during fuel tank repair, 329 
during fueling, 327—328 
Explosive detection systems (EDSs), 446—447 
Explosive trace detection technologies, 445—446, 447f 


Explosives screening, 444, 445—447, 447f 

Exposure, 370 

Exposure data, 370 

Extended-range twin-engine operations (ETOPS), 296 
External audits, 407 

Exxon Valdez oil spill, 197 


FAA. See Federal Aviation Administration 
FAA Modernization and Reform Act (FMRA), 359 
FACs. See Flight augmentation computers 
FADEC. See Full-authority digital engine control 
Fail-safe designs, 274—275 
Failures 
active, 56-57, 108 
complete, 275 
obvious partial, 275 
Fair Treatment of Experienced Pilots Act, 187 
False expectancies, 95, 128 
Family assistance, by NTSB, 228 
FANS. See Future Air Navigation System 
FAR. See Federal Aviation Regulations 
FAROS. See Final Approach Runway Occupancy Signal 
Fatality rates 
vs. accident rates, 370 
Boeing data on, 375, 376f, 377f, 378f 
future of, 491 
trends in, 370 
workplace, 381-382 
Fatigue (human), 100-103 
ASRS examples on, 111, 198-199 
definition of, 100 
effects of, 101 
FAA on, 102, 103, 123, 188 
management plans for, 102—103, 123-124 
NTSB on, 101, 230 
in peak individual performance, 123—124 


types of, 101 
Fatigue Risk Management Plans (FRMPs), 102—103 
Fatigue Risk Management Systems (FRMS), 123-124 
Fatigue-related damage to aircraft, 275-276 
FBI. See Federal Bureau of Investigations 
FBW. See Fly-by-wire 
FDA. See Flight Data Analysis 
FDAP. See Flight Data Analysis Program 
FDAU. See Flight Data Acquisition Unit 
FDM. See Flight Data Monitoring 
FDRs. See Flight data recorders 
Feary, Michael, 105 
Federal Advisory Committee Act, 184 
Federal Air Marshal Program, 434, 434f 
Federal Aviation Act, 316—317 
Federal Aviation Administration (FAA), 175-188. See also Advisory Circulars; 

Air Traffic Control 

on aeronautical decision making, 98—99 

on aging aircraft, 275, 277 

airport certification by, 316-319 

on airspace utilization, 463 

Airworthiness Directives of, 185—186 

AQP of, 131, 255-256 

on ASAP, 249 

in ASIAS, 256-257 

in ASRS, 250-251 

on automation surprise, 106 

Aviation Weather Research program of, 280 

on baggage containers, 450 

on cabin safety, 278 

on cockpit doors, 450 

on commercial space traffic, 467 

on Crew Resource Management, 131 

on cybersecurity, 482 

on evacuation standards, 24 

on fatigue, 102, 103, 123, 188 


on fitness for duty, 100 

on FOQA, 246 

functions and objectives of, 175-177 

on icing, 284, 480 

in International Aviation Safety Assessment, 175 

on laser strikes, 483 

on LOSA, 254 

on no fly zones, 476, 477f 

on noise pollution, 197 

in NTSB investigations, 228—229 

NTSB recommendations to, 216, 226 

on number of aircraft in air, 350 

on oceanic operations, 471 

organization of, 177—181, 178f, 179f 

on pilot health, 485—486 

on portable electronic devices, 232 

recent developments at, 187—188 

recorders required by, 298—299 

rulemaking by, 183—184, 185f, 186-187 

on runway excursions, 338 

on runway incursions, 333, 334f, 336-337 

safety inspection programs of, 182—183 

on Safety Management Systems, 336-337, 390-392, 413-415, 488 

on safety risk management, 396, 397f 

on security, 432—436 

on Unmanned Aircraft Systems, 465 

in wildlife management, 67 
Federal Aviation Regulations (FAR) 

Part 91, 134 

Part 107, 359 

Part 117, 187-188, 198-199 

Part 121, 131, 134, 187, 188, 390-391, 432-433 

Part 135, 187 

Part 139, 317-318, 326, 330, 336, 346, 432 
Federal Bureau of Investigations (FBI), 432, 432f, 436, 442, 483 
Federal Express, 485 


Federal Register, EPA rulemaking in, 194-195 
Field investigations, NTSB, 228 
Final accident reports, NTSB, 225, 226 
Final Approach Runway Occupancy Signal (FAROS), 337 
Findings 
definition of, 208 
in safety risk management, 400 
Fires 
cabin, 278 
during fuel tank repair, 329 
during fueling, 327—328 
FIT. See Florida Institute of Technology 
Fitness for duty, 100—103 
in human error, 100—103 
medical, NTSB on, 231 
psychological, 484—487 
in Safety Management Systems, 487 
5-Factor model, 60—69, 60f 
5-M model, 61 
Flammables, at airports, 322—323 
Flash Airlines, 22 
Flight attendant emergency briefings, 148—150 
Flight attendants 
passenger pre-flight briefings by, 148, 278, 403f 
unions of, 403 
Flight augmentation computers (FACs), 295 
Flight data, routine, 245 
Flight Data Acquisition Unit (FDAU), 246 
Flight Data Analysis (FDA), 245 
Flight Data Analysis Program (FDAP), 245 
Flight Data Monitoring (FDM), 245—246 
Flight data recorders (FDRs) 
digital, 401 
in FOQA programs, 247, 248f 
in NTSB investigations, 219, 220f, 223—224 
technological advances in, 298-299 


Flight decks, 285-287 
development of, 285—286 
future of, 306-309 
human-machine interface in, 285—287, 302—303 
modern, 85, 85f, 88, 89f, 307f 
new enhancements to, 290—295 
standardization of, 301—302 
Flight management systems (FMSs), 64—65, 288, 294, 302-303 
Flight Operational Quality Assurance (FOQA), 27—28, 244-249, 245f, 248f, 490 
Flight Safety Foundation (FSF), 90, 128, 246, 292, 379 
Flight simulators, 297—298 
Flight Standards District Offices (FSDOs), FAA, 182-183, 228 
Flight testing, 298 
FLIR. See Forward looking infrared 
Floor lighting, 278 
Florida Institute of Technology (FIT), 493 
Fly-by-wire (FBW), 65, 267 
FMRA. See FAA Modernization and Reform Act 
FMSs. See Flight management systems 
Followership 
in CRM Pyramid model, 137, 137f, 138-143 
definition of, 138 
key actions of, 140-141 
FOQA. See Flight Operational Quality Assurance 
For-cause testing, 486 
Forensics, 492 
Forward looking infrared (FLIR) cameras, 308—309 
Freedom of Information Act, 257, 440 
FRMPs. See Fatigue Risk Management Plans 
FRMS. See Fatigue Risk Management Systems 
FSDOs. See Flight Standards District Offices 
FSF. See Flight Safety Foundation 
Fuel contamination, 327 
Fuel handling, 326-329, 327f 
Fuel spills, 329 
Fuel systems, 286, 300 


Fuel tank repair, 329 

Full body scanners, 445 

Full-authority digital engine control (FADEC) systems, 65 
Fuse plugs, 271-272 

Future Air Navigation System (FANS), 473 


GADSS. See Global Aeronautical Distress and Safety System 
GAJSC. See General Aviation Joint Steering Committee 
Gap analysis, 415 
Garbage in, garbage out (GIGO), 106-107, 289 
Garrison, Peter, 44 
Gatekeepers, in FOQA programs, 247 
Gates, Bill, 288 
GDRAS. See Ground Data Replay and Analysis System 
GE. See General Electric 
General aviation 
definition of, 2 
NTSB investigations of accidents in, 228 
General Aviation Joint Steering Committee (GAJSC), 256 
General Electric (GE), 268 
Germanwings Flight 9525, 24, 381, 484-487, 484f 
GHS. See Globally Harmonized System of Classification and Labelling of 
Chemicals 
GIGO. See Garbage in, garbage out 
Glass cockpit, 285, 290, 302-303 
Global Aeronautical Distress and Safety System (GADSS), 474 
Global Positioning System (GPS), 66, 350, 354 
Globally Harmonized System of Classification and Labelling of Chemicals 
(GHS), 192 
GMT. See Greenwich Mean Time 
God, Acts of, 9-10, 33 
Goglia, J. J., 390 
Safety Management Systems in Aviation, 416 
Gol Airlines Flight 1907 accident, 362—364, 363f, 404 
Goldilocks zone, 96 
Gore Commission. See White House Commission on Aviation Safety and 


Security 
Go-teams, NTSB, 217, 218-219, 221, 222f 
Government Accountability Office, U.S., 183, 451 
Government regulation, 165—203. See also specific agencies, laws, and 
regulations 
GPS. See Global Positioning System 
GPWS. See Ground-proximity warning system 
Greenhouse gas emissions, 195 
Greenwich Mean Time (GMT), 144 
Ground Data Replay and Analysis System (GDRAS), 247 
Ground Operations Safety Action Program, 403 
Ground vehicles 
ASRS examples of problems with, 340-341 
deviations by, 336 
Grounding, 328 
Ground-proximity warning system (GPWS), 63, 292, 299 
GTA, 22 


Hacking, 451, 452, 481, 482 
Hague Convention, 430 
Hand signals, 146 
Hand-flying skills, 290, 311, 311f 
Hand-wand devices, 446 
Hangars, operational safety in, 321-324 
Hardened unit load devices (HULDs), 450 
Hardware factors, in human performance, 100 
Hart, Christopher A., 218, 219f 
Hawkins, Frank, 59 
Hazard(s) 
definition of, 207, 394 
identification through investigations, 207, 207f 
identification through proactive safety, 244 
vs. risk, 394—395 
Hazard Communication Standard (HCS), 192 
Hazardous materials 
at airports, 322—323 


EPA reporting requirements for, 260—261 
NTSB on, 231-232 
Hazardous Materials Transportation Act (HMTA), 261 
Hazardous waste 
environmental laws on, 196—197 
OSHA standard on, 191 
Hazardous waste operations and emergency response standard (HAZWOPER), 
191 
HCS. See Hazard Communication Standard 
Heads-up displays (HUDs), 308-309, 308f 
Health hazards 
in deicing, 332 
in fuel handling, 326—327 
Health Insurance Portability and Accountability Act (HIPAA), 485 
Helios Airways, 22 
HFACS. See Human Factors Analysis and Classification System 
HFIX. See Human Factors Intervention Matrix 
HICAT. See High Altitude Clear Air Turbulence 
High Altitude Clear Air Turbulence (HICAT), 279 
High-consequence operations, 82 
High-lift systems, 270—271 
High-reliability organizations, 82 
High-risk industries, 82 
ultra-safe, 3—4 
Hijackings. See also September 11, 2001, terrorist attacks 
FAA response to, 432, 433—434 
history of, 428—429, 432, 485 
Hindenburg disaster, 17, 17f 
HIPAA. See Health Insurance Portability and Accountability Act 
HMTA. See Hazardous Materials Transportation Act 
Homeland Security, Department of (DHS), 439, 443, 477 
Homeland Security Act, 439 
HUDs. See Heads-up displays 
HULDs. See Hardened unit load devices 
Hull loss, 371 
Human era of aviation safety, 388 


Human error, 81-118 
ASRS examples of, 110-113 
in automation, 91, 104—107, 288—289 
cognitive, 92—93 
in communication, 103—104 
error chains in, 89—90 
fitness for duty in, 100—103 
philosophy of, 82-84 
vs. pilot error, use of terms, 90—91 
in safety data, 379 
in situational awareness, 93—97 
Human factors 
evolution of thinking on, 41, 41f, 388 
in 5-Factor model, 60-63 
principles of, 88 
in Reason’s “Swiss Cheese” model, 55—56, 108 
in safety data, 379 
science of, 88, 285 
in SHELL model, 59—60 
Human Factors Analysis and Classification System (HFACS), 108—110, 109f 
Human Factors Intervention Matrix (HFIX), 110 
Human Factors Research Project, 379 
Human performance, 97—100 
definition of, 97 
factors affecting, 59, 97-100 
future challenges in, 483—487 
investigations of, 208 
peak individual, 122-124 
Hydraulic systems, 286 


IAMAW. See International Association of Machinists and Aerospace Workers 
IASA. See International Aviation Safety Assessment 

IATA. See International Air Transport Association 

ICAO. See International Civil Aviation Organization 

Ice protection system, 284 

Icing, 283-284, 331-332, 478-480 


IDS. See Integrated display system 
IEP. See Internal inspection program 
IFALPA. See International Federation of Air Line Pilots’ Associations 
IFR. See Instrument flight rules 
IIC. See Investigator-in-charge 
Illnesses 
OSHA reporting requirements on, 258-259 
workplace, 381-383 
ILS. See Instrument Landing System 
Image recorders, NTSB on, 230, 299 
Imaging technologies, 444—445, 444f 
Impairment, drug, NTSB on, 231 
Implementation, of Safety Management Systems, 413—415, 414f 
The Importance of Being Ernest (Wilde), 44 
Improving America’s Security Act, 439 
Incapacitation, ASRS example of, 111-112 
Incidents 
vs. accidents, 4 
definitions of, 4 
investigations of, in safety risk management, 398—401 
Independent Safety Board Act, 215, 216 
India, mental health of pilots in, 487 
Indirect mode change, 106 
Individual performance, peak, 122—124 
Indonesia AirAsia Flight 8501 accident, 470-471 
Influence, of leaders, 120, 138 
Information overload, 85—86 
Infrared deicing systems, 479—480 
Injuries 
OSHA reporting requirements on, 258-259 
probability of, 369 
workplace, 381-383 
Injury accidents, definition of, 5, 371 
Input-Output (IO), 416 
Inspections 
vs. audits, 408 


FAA, 182-183 
in Safety Management Systems, 407—409 
TSA, 427f 
Institute of Aerospace Medicine, 487 
Institute of Medicine, 3 
Instrument flight rules (IFR), 351 
Instrument Landing System (ILS), 353 
Integrated display system (IDS), 287 
Intelligence, role in security, 441-443 
Intelligence Reform and Terrorism Prevention Act (IRTPA), 442, 449 
Internal audits, 407 
Internal evaluation audits, 407 
Internal inspection program (IEP), 409 
International accident investigations, 212—214 
International accident rates, 381 
International Air Transport Association (IATA) 
in evolution of Crew Resource Management, 128 
on human factors, 379 
on number of passengers, 6 
on safety as priority, 2 
on safety data, 379, 381 
on safety performance indicators, 406 
on security, 431 
on volcanic ash, 281 
International Association of Machinists and Aerospace Workers (IAMAW), 403 
International Aviation Safety Assessment (IASA), 175 
International Civil Aviation Organization (ICAO), 167—175. See also Chicago 
Convention 
on age limit for pilots, 187 
Committee on Aviation Environmental Protection, 197 
establishment of, 168, 212, 389 
on findings, 208 
on Flight Data Monitoring, 245, 246 
in international accident investigations, 212—214 
on LOSA, 254 
on no fly zones, 476—477 


objectives of, 167, 168 

on oceanic operations, 471, 474 

offices of, 168—169, 169f 

organization of, 168—170, 171, 172f 

rulemaking by, 172-174 

on runway incursions, 333, 336—337 

safety data of, 381 

Safety Management Manual of, 41, 57, 388, 405, 408 

on Safety Management Systems, 174-175, 336, 389-391, 488 

on safety performance indicators, 405—406 

safety ratings by, 175 

on safety risk management, 396, 396f 

on security, 430—431 

Security Manual of, 431 

on SHELL model, 59 

on types of accidents, 5, 371 

on volcanic ash, 281, 282 
International cooperation, in investigations, 492 
International Federation of Air Line Pilots’ Associations (IFALPA), 401, 486 
International Organization for Standardization (ISO), 389 
International Security and Development Cooperation Act, 434 
International Society of Air Safety Investigators, 208 
Interpersonal skills, of investigators, 491 
The Intruders (Coonts), 121—122 
Investigations, accident, 206-214. See also National Transportation Safety 

Board 

case study on, 232-239 

causes in, 208—211 

engineering technical vs. human performance, 208 

field portion of, 39, 40f 

findings in, 208 

future of, 491—492 

goals of, 39—40, 207 

international, 212—214 

manufacturers’ role in, 373 

monocausal approach to, 211 


on-site, 221-223, 223f 

recommendations in, 211—212 

in Safety Management Systems, 398—401, 407 

technological advances in, 298-299 

training for, 491—492, 493f 

unions in, 402 
Investigator-in-charge (IIC), FAA, 229 
Investigator-in-charge (IIC), NTSB, 218-219, 220, 229 
IO. See Input-Output 
Iran, national culture of, 153 
IRTPA. See Intelligence Reform and Terrorism Prevention Act 
ISO. See International Organization for Standardization 


Japan, Total Quality Management in, 388 
Jet engines 
development of, 267—269 
emissions from, 261 
Jet upsets, 279 
JetBlue Airlines Flight 292, 155—156, 156f 
Johns Hopkins University School of Medicine, 90 
Judgment, in human performance, 98-99 
Juran, Joseph, 388 
Just culture, 124, 392 


Klimoski, R., 150 
KLM Airlines 
Crew Resource Management at, 129 
in Tenerife accident, 14—15, 15f, 18 
Know Before You Fly campaign, 465 
Korean Air Flight 858 bombing, 428 


Labor, Department of, 382 

Labor unions. See Unions 

Laboratory, NTSB, 210, 210f, 223-224, 224f 
LASC. See Local council air safety chairperson 
Laser jammers, 476 


Lasers, 483 
Latent conditions, 56—58, 108 
Latent errors, 55 
Lauber, John, 129 
Law of unintended consequences, 12—13 
LCD. See Liquid crystal display 
Lead standards, 191 
Leadership 
in CRM Pyramid model, 137, 137f, 138-143 
definition of, 138 
influence of leaders in, 120, 138 
key actions of, 139-140 
vs. management, 138-139 
participative, 133 
skills of, 120 
Leading-edge flaps, 270-271 
LEC. See Local executive council 
Lederer, Jerome, 44 
Lewis Research Center, NASA, 284 
Lighting 
cabin floor, 278 
flight deck, 287 
runway, 337 
Likelihood, in risk, 5—6 
Line Operations Safety Audit (LOSA), 28, 106, 254—255, 490 
Line Oriented Evaluations (LOEs), 131 
Line-Oriented Flight Training (LOFT), 130, 130f 
Link, Ed, 297 
Lion Air, 38, 38f 
Liquid crystal display (LCD), 290, 291, 306-307 
Listening, active, 139 
Lithium batteries, 231—232 
Liveware, in Crew Resource Management, 129 
Load-shedding feature, 286 
Local council, 401 
Local council air safety chairperson (LASC), 401—402 


Local executive council (LEC), 401—402 
Lockout and tagout (LOTO), 324 
LOEs. See Line Oriented Evaluations 
LOFT. See Line-Oriented Flight Training 
Logbook, aircraft, 413 
Long-range commercial aircraft, 269-278 
LOSA. See Line Operations Safety Audit 
LOTO. See Lockout and tagout 
Low-speed stall, 273 
Lubitz, Andreas, 484 
Luck 

and accident causation, 69—70 

and professionalism, 121—122 


Machine factors, in 5-Factor model, 60—61, 63—66, 64f 
Machine intelligence, 494—499 
Main causes, 211 
Maintenance shops, operational safety in, 321—324 
Maintenance technicians, unions of, 403 
Major accidents, definition of, 5, 371 
Malaysia Airlines 
Flight 17 missile attack, 24, 40f, 474, 475f, 476f 
Flight 370 disappearance, 23—24, 471, 472, 492 
Management. See also Safety Management Systems 
definition of, 138 
vs. leadership, 138-139 
Management factors, in 5-Factor model, 60—61, 68—69 
Mandala, 22 
Manual reversion, 286 
Manufacturers, involvement with safety data, 373—374 
Marijuana, 231 
Mariner 1 spacecraft, 481 
Maritime industry, 41—42, 42f 
Mars Climate Orbiter, 481 
Master executive council (MEC), 402 
Material safety data sheets (MSDS), 332 


McDonnell Douglas MD-82, 233 
MEC. See Master executive council 
Medical fitness, NTSB on, 231 
Medicines, impairment caused by, 231 
Medium factors, in 5-Factor model, 60—61, 66-68 
Memory, in human performance, 97—98 
Mental health, 484—487 
Mergers, airline, 183 
Metal detectors, 447—448, 448f 
Metallurgy, 224 
Metrojet Flight 9268, 381 
MFDs. See Multifunction displays 
Midair collisions, 362—364, 363f 
Military aviation 
definition of, 3 
history of accidents in, 16 
Miller, George, 87 
Miller’s law, 87 
Millimeter-wave scanners, 445 
Millward, S. M., 150-152 
Missiles, surface to air, 474—478, 475f, 476f 
Mission factors, in 5-Factor model, 60—61, 68 
Mode confusion, definition of, 105—106 
Model aircraft, 359 
Models, 53—69 
for aircraft design, 295—299 
DECIDE, 99, 99f 
definition of, 54 
5-Factor, 60—69, 60f 
Pyramid, of CRM, 136-155, 137f 
Reason’s “Swiss Cheese,” 54—58, 55f, 56f, 58f, 108, 388 
SHELL, 59-60 
Mohammed, S., 150 
Monitoring, continuous, 407 
Monocausal approach, 211 
Montano, Alfonso, 218, 219f 


Most Wanted List, NTSB, 230-232, 299, 333, 487 
Motivation, in human performance, 97 
Mountain waves, 280—281 
Moving walkways, 321 
MSD. See Multiple-site damage 
MSDS. See Material safety data sheets 
Multi-causality concept 
in Air France Flight 4590 accident, 75 
definition of, 90, 211 
importance of understanding, 33—34 
origins of, 9, 211 
Multifunction displays (MFDs), 288, 291, 307, 307f 
Multiple-site damage (MSD), 277 
Multizone approach to metal detectors, 448 
Myths 
pilot error as, 9, 90-92 
safety, 7—10 


NAICS. See North American Industry Classification System 
NAS. See National Airspace System 
NASA. See National Aeronautics and Space Administration 
National Academy of Engineering, 11 
National Aeronautics and Space Administration (NASA). See also Aviation 
Safety Reporting System 
in ASRS, 250-251 
on effectiveness of Crew Resource Management, 136, 136f 
in evolution of Crew Resource Management, 128, 129, 131 
Lewis Research Center of, 284 
on mode confusion, 106 
software problems at, 481 
National Airspace System (NAS), U.S., 181 
establishment of, 352 
evolution of, 350 
future of, 463-464 
Unmanned Aircraft Systems in, 359 
WAAS in, 354 


National Airspace System Voice System (NVS), 356 
National Center for Atmospheric Research (NCAR), 280, 284, 480 
National Commission on Terrorist Attacks. See 9-11 Commission 
National Counterterrorism Center (NCTC), 441—443 
National culture 

definition of, 153 

in Pyramid model of CRM, 153 
National Environmental Policy Act (NEPA), 195 
National Fire Protection Association (NFPA), 320-326 
National Implementation Plan for the War on Terror, 443 
National Institute for Occupational Safety and Health (NIOSH), 189-191 
National Reconnaissance Office, 442 
National Runway Safety Plan, FAA, 333, 336-337, 338 
National Security Agency, 442 
National Strategy for Aviation Security, 443 
National Survey on Drug Use and Health (NSDUH), 485 
National Transportation Safety Board (NTSB), 214—232 

on cabin safety, 278 

classification of accidents by, 39 

databases of, 229 

establishment of, 215 

on fatigue, 101, 230 

final reports of, 225, 226 

on icing, 284 

investigation process of, 218—228 

laboratory of, 210, 210f, 223—224, 224f 

mission of, 214—216 

Most Wanted List of, 230—232, 299, 333, 487 

on multi-causality, 9, 211 

organization of, 217—218, 217f 

party system of, 220-221, 373 

on professionalism, 122 

public hearings of, 225—226 

recommendations of, 216, 226—228 

on recorders, 219, 220f, 223—224, 230, 298-299 

on safety culture, 155 


safety data of, 379-380 
special studies by, 216 
on turbulence, 279—280 
National Weather Service (NWS), 279-280 
NAVAIDS. See Navigational Aids 
Navigation. See also Global Positioning System 
future of, 304—305, 354 
performance-based, 353-354 
precision, 302—303 
satellite-based, 304—305, 354-355 
Navigation display (ND), 287 
Navigational Aids (NAVAIDS), 353 
NCA. See Noise Control Act 
NCAR. See National Center for Atmospheric Research 
NCTC. See National Counterterrorism Center 
ND. See Navigation display 
Near-miss data, 489 
NEPA. See National Environmental Policy Act 
Next Generation (NextGen) 
in Air Traffic Control, 350, 350f, 352, 356-358 
in airspace utilization, 463—464 
in flight operations, 309 
in weather detection, 356—357 
Next Generation (NextGen) in Air Transportation System, FAA Office of the, 
180-181 
NFPA. See National Fire Protection Association 
9-11 Commission, 437—439, 441—442, 449 
NIOSH. See National Institute for Occupational Safety and Health 
No drone zones, 465 
No Fly Watch List, 449 
No fly zones, 476—477, 477f 
No secret typing, 289 
Noise 
in flight decks, 286-287 
regulation of, 197—198 
Noise Abatement and Control, EPA Office of, 197 


Noise Control Act (NCA), 197—198, 198f 

Noncontact technique, 446 

Non-hull loss, 371 

North American Industry Classification System (NAICS), 382-383 
Northwest Airlines Flight 255 accident, 19, 233 
NOTAMS. See Notices to Airmen 

Notation draft, 226 

Notices to Airmen (NOTAMs), 476 

NSDUH. See National Survey on Drug Use and Health 
NTSB. See National Transportation Safety Board 
NVS. See National Airspace System Voice System 
NWS. See National Weather Service 


OAS. See Aviation Safety, NTSB Office of 
Obvious partial failure, 275 
Occupant protection systems, NTSB on, 230 
Occupational accidents, statistics on, 381-383 
Occupational Safety and Health Act (OSHA), 24, 188-189 
Occupational Safety and Health Administration (OSHA), 188—192 
on airport operations, 320-323, 329, 330 
Forms 300, 300A, and 301 of, 258-259 
mission of, 188—189, 258 
on occupational accidents, 382 
organization of, 189, 190f 
reporting requirements of, 258—259 
rulemaking by, 189-191 
standards of, 191—192 
Oceanic operations, 472f 
accidents in, 470—473 
future of, 357—358, 470-474 
NextGen, 357—358 
tracking of, 358, 470-474 
ODI. See OSHA Data Initiative 
Ohain, Hans von, 268 
Oil Pollution Act (OPA), 197 
Operation Entebbe, 429, 430f 


Operational incidents, 336 
Operational safety, at airports, 320—332 
Organizational culture 

definition of, 154 

in Pyramid model of CRM, 153, 154-155 
Organizational era of aviation safety, 388—389 
Organizational factors 

evolution of thinking on, 41, 41f, 388—389 

in peak individual performance, 123 
OSHA. See Occupational Safety and Health Act; Occupational Safety and 

Health Administration 

OSHA Data Initiative (ODI), 258 


Painting, of aircraft, 189, 189f, 323 
Pan Am 

Flight 103 bombing, 19, 428, 434—435, 435f 

in Tenerife accident, 14—15, 15f, 18 
PANS. See Procedures for Air Navigation Services 
PAPI. See Precision Approach Path Indicator 
Participation, authority with, 133-134, 139 
Particle detection, 446 
Party line effect, 103 
Party system of NTSB, 220-221, 373 
Passenger(s) 

annual number of, 6 

with disabilities, 320 

pre-flight briefings of, 148, 278, 403f 
Passenger screening, 447, 455f 

challenges of, 455—456 

cost of, 455 

origins of, 433 

by TSA, 439, 444—449 
Passenger-miles, 370 
Passive safety devices, 398 
PBN. See Performance-based navigation 
Peak individual performance, 122—124 


Pedestrian deviations, 336 
PEDs. See Portable electronic devices 
Peer pressure, in human performance, 99 
Perception 
in human performance, 98 
in situational awareness, 94 
Performance indicators, 387, 405. See also Safety performance indicators 
Performance-based navigation (PBN), 353-354 
Personal protective equipment (PPE), 398 
Personality traits, in human performance, 97—98 
PFDs. See Primary flight displays 
Philosophy 
of human error, 82—84 
safety, 7-13 
Phonetic alphabet, 143 
Physical factors 
in human performance, 59, 97 
in peak individual performance, 122—123 
Physiological factors, in human performance, 59, 97 
PIC. See Pilot-in-command 
Pilot(s) 
age limit for, 187 
authority of, 133-134 
decline in perceived prestige of, 133-134 
desirable traits in, 84—86 
priorities of, 87-88, 87f 
psychological fitness for duty of, 484—487 
unions of, 401—404 
Pilot deviation, 336 
Pilot error 
vs. human error, use of term, 90—91 
inappropriate use of term, 63 
as myth, 9, 90-92 
Pilot-in-command (PIC) 
authority of, 134 
as CEO, 139 


Pollution laws, 195—198 
Popular Front for the Liberation of Palestine, 429 
Portable electronic devices (PEDs) 
as distraction, 107, 231 
lithium batteries in, 231—232 
Portal sampling, 446 
Positive controlled airspace, 352 
Post-event debriefings, 151 
Power distance, 153 
PPE. See Personal protective equipment 
Pratt & Whitney (P&W), 268 
Pre-check, TSA, 449 
Precipitation, 283—284, 480 
Precision Approach Path Indicator (PAPI), 337 
Precursors 
to accidents, 10—11 
definition of, 11 
Predetermined crew roles, 151 
Prediction 
of accidents, 8—9 
with artificial intelligence, 496—497 
Predictive safety 
definition of, 28, 40, 244, 491 
evolution of, 40—41, 41f 
examples of, 28-29, 491 
Presidential Commission on Aviation Security and Terrorism, 435 
Preventative action, 408 
Primary causes, 211 
Primary flight displays (PFDs), 287 
Privacy rights, 486 
Proactive safety, 27—29, 243-264. See also Aviation Safety Reporting System 
AQP as, 255—256 
ASAP as, 27, 249-250, 490 
ASIAS as, 256-257 
definition of, 40, 244, 408 
evolution of, 40—41, 41f, 489—490 


examples of, 29 

FOQA as, 27-28, 244-249, 490 

future of, 490—491 

goal of, 40 

LOSA as, 28, 254-255, 490 

origins of, 490 

in Safety Management Systems, 408 
Probability 

in accident probability alerting threshold, 496, 498 

of death or injury, 369-370 

in risk, 370, 395—398 
Probable cause, NTSB determination of, 214, 215 
Procedures and training, 398 
Procedures for Air Navigation Services (PANS), 172-173 
Professional culture 

definition of, 154 

in Pyramid model of CRM, 153, 154 
Professionalism, 121—126 

definition of, 121 

empowered accountability in, 121, 124-126 

in 5-factor model, 68 

peak individual performance in, 122-124 
Profit, as priority, 8, 387 
Projection, in situational awareness, 94 
Protections, in fly-by-wire aircraft, 267 
Protective breathing equipment, 278 
PSA Airlines Flight 2495, 343-344, 344f, 345f 
Psychological factors, in human performance, 59, 97—99 
Psychological fitness for duty, 484—487 
Psychosocial factors, in human performance, 59, 99—100 
Public hearings, NTSB, 225-226 
Publications 

of ASRS, 252-254 

in Safety Management Systems, 412 
Puffer machine, 446 
Pure Hacking, 482 


Pyramid model. See Crew Resource Management, Pyramid model of 


Al-Qaeda, 426—427, 474. See also September 11, 2001, terrorist attacks 
Qantas, 23 
Quick Access Recorders (QARs), 246, 247 


Radar, 353, 463, 471 
Radio communication, 103—104 
Ramps 
ASRS examples of problems on, 338—340 
operational safety on, 324—326, 325f 
RCRA. See Resource Conservation and Recovery Act 
Reactive safety, 205—242. See also Investigations 
definition of, 27, 39, 244, 408, 489 
examples of, 29 
Readback process, 145 
Reagan, Ronald, 433—434 
Reason, James T., “Swiss Cheese” model of, 54—58, 55f, 56f, 58f, 108, 388 
Reasonable person concept, 48 
Recognition, in biometric systems, 449 
Recommendations, investigation 
definition of, 211—212 
NTSB, 216, 226-228 
in safety risk management, 400 
Recommended Practices 
definition of, 173 
ICAO, 170, 172-173 
Recorders. See Cockpit voice recorders; Flight data recorders; Video recorders 
Red herrings, 234 
Red Zone, 476 
Redress numbers, 449 
Reduced Vertical Separation Minimums (RVSM), 358 
Redundancies, in flight deck, 286 
Regional Offices of EPA, 194 
Regional Supplementary Procedures (SUPPs), 172—174 
Regulation. See Government regulation 


Rejected takeoff (RTO), 272 
Remotely piloted aircraft (RPA). See Unmanned Aircraft Systems 
Reportable quantities (RQs), 260 
Reporting requirements 
EPA, 260-261 
OSHA, 258-259 
Reporting systems, employee, 407 
Reports 
NTSB final accident, 225, 226 
Service Difficulty, 373 
writing of, 491 
Required navigation performance (RNP), 354, 463—464, 464f 
Research and Development, EPA Office of, 194 
Resource Conservation and Recovery Act (RCRA), 196, 260, 261 
Respect, assertiveness with, 134-135, 141 
Rest requirements, 187—188 
Risk, 5—7 
ALARP approach to, 11 
definition of, 5, 394 
formula for, 394—395 
vs. hazard, 394—395 
as probability of death, 370 
Risk management, 5—6. See also Safety risk management 
Risk taking, in human performance, 98 
Risk tolerability matrix, 396, 396f 
RNAV. See Area navigation 
RNP. See Required navigation performance 
Root causes 
vs. active causes, 45, 49—50 
alternative terms for, 49 
case studies on, 46—52 
definition of, 45 
in Reason’s “Swiss Cheese” model, 55 
Routine flight data, 245 
Rovinescu, Calin, 2 
RPA (remotely piloted aircraft). See Unmanned Aircraft Systems 


RQs. See Reportable quantities 
RTO. See Rejected takeoff 
Rulemaking 

by EPA, 194-195 

by FAA, 183-184, 185f, 186-187 

by ICAO, 172-174 

by OSHA, 189-191 
Runway excursions, 337—338 
Runway incursions, 332-337, 334f, 341-343 
Runway Safety, FAA Office of, 336 
Runway Status Lights (RWSL), 337 
RVSM. See Reduced Vertical Separation Minimums 
RWSL. See Runway Status Lights 


SA. See Safety assurance; Situational awareness 
Safety. See also specific safety concerns and types 
ethics of, 10-13 
evolution of thinking about, 40—41, 41f, 388-389, 389f 
history of, 15—24 
measuring, 25—26 
myths about, 7—10 
vs. security, 13—15, 34, 426 
as top priority, 2, 8, 387 
Safety Action Group (SAG), 394 
Safety assurance (SA), in Safety Management Systems, 392, 404—409, 488 
Safety culture, 124, 155 
Safety factors, definition of, 369 
Safety indicators, definition of, 369 
Safety management. See Safety Management Systems 
Safety Management Manual (ICAO), 41, 57, 388, 405, 408 
Safety Management Systems (SMS), 385—424 
allocation of funds to, 387 
ASRS examples of problems with, 417—420 
definition of, 386—387, 488 
evolution of, 388-391, 389f 
FAA on, 336-337, 390-392, 413-415, 488 


fitness for duty in, 487 
future challenges in, 415-417, 488—491 
ICAO on, 174-175, 336, 389-391, 488 
objective of, 387, 387f, 488 
origins of, 386 
performance indicators in, 387 
phased approach to implementation of, 413—415, 414f 
safety assurance in, 392, 404—409 
safety policy in, 392—394 
safety promotion in, 392, 409-413 
safety risk management in, 392, 394—404 
summary of components of, 391—392, 393f, 420—421, 488 
Safety Management Systems in Aviation (Stolzer and Goglia), 416 
Safety performance indicators (SPIs), 25-26, 387, 405—407, 406f 
Safety policy, in Safety Management Systems, 392-394, 488 
Safety promotion, in Safety Management Systems, 392, 409-413, 410f, 488 
Safety Review Board (SRB), 394 
Safety risk management (SRM) 
after investigations, 207 
in Safety Management Systems, 392, 394—404, 488 
tolerability in, 396, 396f 
Safety training program, 410—411 
Safety value chain, 84, 386 
SAG. See Safety Action Group 
Salas, E., 150 
Sample collection, 445—446 
SAMs. See Surface to air missiles 
Samsung Galaxy Note 7, 232 
SARA. See Superfund Amendments and Reauthorization Act 
SARPs. See Standards and Recommended Practices 
Satellite(s). See also Global Positioning System 
in airspace utilization, 463—464 
navigation with, 304-305, 354—355 
weather detection with, 304 
Satellite surveillance, 463—464 
SATMS. See Space and Air Traffic Management System 


Screening. See also Passenger screening 
of airport workers, 456 
challenges of, 455—456 
cost of, 455 
technologies for, 444—449, 455 
Seats, in cabin safety, 278 
Secretariat of ICAO, 170, 171f, 172f 
SECs. See Spoiler/elevator computers 
Secure Flight Program, TSA, 449 
Security, 425—459. See also Transportation Security Administration 
ASRS examples of problems with, 452—455 
and authority of pilots, 134 
against cyberattacks, 450-452, 480—483 
history of significant attacks, 427—429 
intelligence in, 441—443 
international approach to, evolution to, 430—432 
regulatory developments in, 429—439 
vs. safety, 13-15, 34, 426 
screening technologies in, 444—449, 455 
types of threats to, 426 
U.S. approach to, evolution of, 432—439 
Security Management System (SeMS), IATA, 431—432 
Security Manual (ICAO), 431 
Self-audits, 409 
Self-discipline, in human performance, 98 
SeMS. See Security Management System 
Seneca, 89 
September 11, 2001, terrorist attacks, 426, 436—439, 437f 
9-11 Commission on, 437—439, 441-442, 449 
casualties of, 429, 436-437 
security after, 13, 429-430 
Serious accidents, definition of, 5, 371 
Service Difficulty Reports, 373 
Severity, in risk, 5-6, 395-398, 397f 
Shappell, Scott, 108—110 
Shared Situational Awareness (SSA) 


alternative terms for, 150 
in CRM Pyramid model, 137, 137f, 150-152 
definition of, 137, 150 
SHELL model, 59-60 
Shift work, 102 
Shoe bombing attempt, 429 
SIC. See Standard Industrial Classification 
Simulators 
flight, 297-298 
icing, 480 
Singapore Airlines 
Flight 006 accident, 21 
team approach to safety at, 120, 121f 
Sites, accident, 221—223 
Sitts, Shane, 12 
Situation Awareness Error Taxonomy, 94 
Situational awareness (SA), 93-97. See also Shared Situational Awareness 
automation in gains in, 86 
and cognitive error, 92, 95 
definitions of, 93—94 
expectancies in, 95—96 
three levels of, 94—95 
Skiles, Jeff, 70 
Sky Marshal Program, 433 
“Skygirls,” 128 
SLD. See Super-cooled large drops 
Sleeping giants, 480—481 
Small Unmanned Aircraft Systems (SUAS), 359-360 
Smartphones, as distraction, 107 
SMS. See Safety Management Systems 
SMS Advisory and Rulemaking Committee (ARC), 390, 488 
Soft defenses, 299 
Soft skills, of pilots, 86 
Software safety, 450-452, 480—483 
Southwest Airlines, Flight Data Analysis Program of, 245 
Southwest Airlines Pilots’ Association (SWAPA), 401 


Space and Air Traffic Management System (SATMS), 467—468 
Space tourism, 466. See also Commercial space operations 
Space transition corridors (STCs), 468—469 
Spanair Flight 5022 accident, 23, 232-239, 232f, 236f 
Sparks, 328 
Special use airspace, 352 
Special Weapons and Tactics (SWAT) Team, 432, 432f 
Specialized airport services, 326-332 
Speed, in human performance, 97 
Speed brakes, 272 
SPIs. See Safety performance indicators 
Spoiler/elevator computers (SECs), 295 
SRB. See Safety Review Board 
SRM. See Safety risk management 
SSA. See Shared Situational Awareness 
Stall characteristics, low-speed, 273 
Standard(s) 
definition of, 173 
ICAO, 170, 172-173 
OSHA, 191-192 
Standard Industrial Classification (SIC) Manual, 382 
Standard Terminal Automation Replacement System (STARS), 355 
Standardization, of flight decks, 301—302 
Standardized International Aircraft Ground Deice Program, 332 
Standards and Recommended Practices (SARPs), 170, 172—173, 389, 430-431 
STARS. See Standard Terminal Automation Replacement System 
Static electricity, 328 
Statistical process control limits, 406—407 
Statistics. See Data 
Status audits, 409 
STCs. See Space transition corridors 
Sterile cockpit rule, 86-87, 231 
Sterile operation, 289 
Stethem, Robert, 433 
Stick-shaker, 273 
Stolzer, A. J., 390 


Safety Management Systems in Aviation, 416 
Stopping systems, 271-273 
Stress, in human performance, 99 
Stripping, 323 
Structural integrity of aircraft, 273-277 
STUFF acronym, 151-152 
SUAS. See Small Unmanned Aircraft Systems 
Suicide, pilot, 484 
Sullenberger, Sully, 70 
Sumwalt, Robert, 131 
Super-cooled large drops (SLD), 480 
Superfund, 196—197 
Superfund Amendments and Reauthorization Act (SARA), 196-197 
SUPPs. See Regional Supplementary Procedures 
Surface to air missiles (SAMs), 474—478, 475f, 476f 
SVS. See Synthetic vision system 
Swab approach, 446 
SWAPA. See Southwest Airlines Pilots’ Association 
SWAT. See Special Weapons and Tactics 
SWIM. See System Wide Information Management 
“Swiss Cheese” model, 54—58, 55f, 56f, 58f, 108, 388 
Synthetic vision system (SVS), 308-309 
System assessment, 407 
System software, 67 
System Wide Information Management (SWIM), 356 


TAG. See Transcockpit Authority Gradient 
Takeoff, rejected, 272 
Takeoff briefings, 148 
Takeoff warning system (TOWS), 235-236 
Tam Airlines, 22 
TAMR. See Terminal automation modernization and replacement 
Task factors, in human performance, 100 
TCAS. See Traffic collision avoidance system 
Teamwork. See also Crew Resource Management 
in approach to safety, 120, 121f 


culture’s role in, 153 
Technical centers, FAA, 181 
Technical era of aviation safety, 388 
Technical factors, evolution of thinking on, 41, 41f, 388 
Technical investigations, 208 
Technological advances 
in artificial intelligence, 494-499 
in investigations, 298—299 
in security, 443—450, 455 
TEM. See Threat and Error Management 
Tenerife accident, 14-15, 15f, 18, 104, 128, 332-333 
Terminal automation modernization and replacement (TAMR), 355 
Terminal buildings, airport, 320-321 
Terminal Flight Data Manager (TFDM), 356-357 
Terminal radar approach control (TRACON) facilities, 353 
Terrorism. See also Bombings; Hijackings; September 11, 2001, terrorist attacks 
cyberattacks in, 450—451, 482 
evolution of tactics of, 429 
international response to, 430—432 
surface to air missiles in, 474 
U.S. intelligence on, 441—443 
war on, 436—437, 443 
TFDM. See Terminal Flight Data Manager 
TFM. See Traffic flow management 
Thailand, 175 
Threat(s) 
aircraft control strategies for management of, 299-303 
definition of, 131 
modeling of, 451-452 
in TEM framework, 131-132 
Threat and Error Management (TEM), 89, 131-132 
Three-step causation test, 208—211 
Thrust reversers, 272 
Ticket counters, 321 
Tokyo Convention, 430 
Tolerability, in safety risk management, 396, 396f 


Tolerance 
damage, 274-275, 276 
error, 303 
Top management review, 408 
Total Quality Management (TQM), 388 
TOWS. See Takeoff warning system 
Toxic substances, at airports, 322-323 
Toxic Substances Control Act (TSCA), 260, 261 
TQM. See Total Quality Management 
Trace detection technologies, 445—446, 447f 
Tracking, of oceanic flights, 358, 470—474 
Tracking system, distress, 474 
TRACON. See Terminal radar approach control 
Traffic collision avoidance system (TCAS), 292 
Traffic flow management (TFM), 356 
Trailing-edge flaps, 270 
Training, 398 
of accident investigators, 491—492, 493f 
pilot, 186-187 
safety, 410-411 
Trans World Airlines. See TWA 
Transcockpit Authority Gradient (TAG), 141-143, 142f 158 
Transient fatigue, 101 
Transportation, Department of (DOT) 
on fatality rate, 491 
and NTSB, 215 
and TSA, 439 
Transportation Disaster Assistance Division, NTSB, 228 
Transportation Security Administration (TSA), 427f, 439-441 
Aircraft Operations Standard Security Program of, 433 
establishment of, 439 
mission of, 439 
regulations of, 440—441 
screening techniques of, 444—449 
Transportation Security Regulations (TSRs), 440—441 
Trend analysis, 374 


Trigger causes, 211 
TSA. See Transportation Security Administration 
TSCA. See Toxic Substances Control Act 
TSRs. See Transportation Security Regulations 
Turbulence 

safety design for, 279-280 

safety performance indicators for, 406, 406f 
Turkish Airlines Flight 1951 accident, 481 
TWA, 18, 351 

Flight 514 accident, 18, 252, 262 

Flight 800 accident, 20-21, 227, 436 

Flight 847 hijacking, 433, 434 
Twain, Mark, 12, 383, 462 
24-hour clock, 143-144 


UAS. See Unmanned Aircraft Systems 
UAV. See Unmanned Aircraft Systems 
Ultra-safe high-risk industries (USHRIs), 3—4 
UN. See United Nations 
Uncontrolled airspace, 352 
Underground storage tanks (USTs), 329 
Understanding, in situational awareness, 94 
Underwear bombing attempt, 429 
Unintended consequences, law of, 12—13 
Unions, in Safety Management Systems, 401—404 
United Airlines 
accidents in 1950s and 1960s, 18 
Crew Resource Management at, 129 
Flight 93 hijacking, 436—437 
Flight 173 accident, 129 
Flight 175 hijacking, 436 
Flight 232 accident, 130 
Flight 585 accident, 19 
United Nations (UN). See also International Civil Aviation Organization 
on aviation security, 431 
Globally Harmonized System of Classification and Labelling of Chemicals, 


192 
Resolution 2309, 431 
Universal Safety Oversight Audit Program, 174 
Universal Security Audit Programme Continuous Monitoring Approach (USAP- 
CMA), 431 
University of Texas, 106, 379 
Unmanned Aerial Vehicles (UAV). See Unmanned Aircraft Systems 
Unmanned Aircraft Systems (UAS), 358—360, 466f 
commercial, 359—360 
future challenges with, 465 
rise of, 352, 358-359, 465 
small, 359—360 
Unsafe acts 
causes of, 43—44 
consequences of, 44 
in HFACS, 108-109, 109f 
in Reason’s “Swiss Cheese” model, 56—57, 108 
UPS 
CDTI use by, 305 
Flight 1354 accident, 48—49, 49f, 214f 
U.S. Aeronautical Information Manual, 144—145 
U.S. Airways 
Flight 427 accident, 20 
Flight 1016 accident, 20 
Flight 1493 accident, 19 
Flight 1549 accident, 23, 70 
Flight 1702 accident, 107 
USAP-CMA. See Universal Security Audit Programme Continuous Monitoring 
Approach 
USHRIs. See Ultra-safe high-risk industries 
USTs. See Underground storage tanks 
UTA Flight 772 bombing, 428 
UTC. See Coordinated Universal Time 


ValuJet Flight 592 accident, 20, 231 
Vapor detection, 446 


VDL. See VHF Datalink 

Vehicle deviations, 336 

Verification, in biometric systems, 449 

Very high frequency (VHF) communications, 305 
VER. See Visual flight rules 

VHF. See Very high frequency 

VHF Datalink (VDL), 305 

VHF Omni-directional range (VOR), 353 

Victim blaming, 11-12 

Video recorders, NTSB on, 230, 299 

Virgin Atlantic, 473 

Visual conceptual models, definition of, 54. See also Models 
Visual flight rules (VFR), 351 

Voice communication, future of, 304—306 
Volcanic ash, 67, 281-282, 282, 283f 

VOR. See VHF Omni-directional range 


WAAS. See Wide Area Augmentation System 
War on terrorism, 436—437, 443 
Warning devices, 397—398 
Water, EPA Office of, 194 
Wear-out phase, 277 
Weather 
improvements in forecasting, 356-357, 480 
myths about, 9 
NextGen, 356-357 
safety design for, 279—284, 304 
Weather Support to Deicing Decision Making (WSDDM), 480 
West Caribbean Airways, 46—47, 46f 
Westinghouse, 268 
WED. See Widespread fatigue damage 
Whistleblowers, 12 
White House Commission on Aviation Safety and Security, 436 
Whittle, Frank, 268 
Wide Area Augmentation System (WAAS), 354 
Widespread fatigue damage (WFD), 277 


Wiegmann, Douglas, 108—110 
Wilde, Oscar, The Importance of Being Ernest, 44 
Wildlife, in 5-Factor model, 67 
Wind shear, 280-281 
accidents involving, 48, 280-281 
detection of, 280—281, 304 
Windshields, 286—287 
Wind-tunnel testing, 297 
Wing buffeting, 273 
Wing design, computational fluid dynamics in, 296 
Wing spoilers, 272 
Wiring safety, 480 
Within-fleet standardization, 301—302 
Witnesses, expert, 225 
Women, in early aviation, 127—128 
Working group teams, NTSB, 219 
Wright Brothers, 15—16, 16f 
Writing skills, of investigators, 491 
WSDDM. See Weather Support to Deicing Decision Making 


X-ray imaging, 445 
Yellow Zone, 476 


Zagros Airlines, 153, 154f 


